remote-pdb VS python-uncompyle6

pdbpp: Improved pdb boltons: assorted python addtions twisted: event driven networking framework sorcery: Dark magic in python, things know where+how they are being called, helps reducing boilerplate sh: Better alternative for subprocess module, much more pythonic taskipy: npm run scipt_name like functionality snoop: pdb lite, record+replay function steps birdseye: graphical debugger remote-pdb: easy pdb from inside containers typer: wrapper around click for simpler code for CLIs arrow: Always TZ aware datetimes, plus more features more-itertools: more functions for iterators pydantic: data validation + dataclasses loguru: better logging notifiers: sending notifications from python

Q: What is RAPID_API_KEY = os.environ.get('RAPID_API_KEY')? A: You should store configuration in environment variables; never in code. See 12 factors app. Python .pyc files can easily be "decompiled" to .py and reveal all secrets in code.

I was able to figure out that this is a python program which was compiled to an .exe. Using uncompyle6 and pyc2bytecode, I was able to decompile the .exe into the python bytecode...but I'm no expert at reading python bytecode. If you want to do this yourself, note that you will need to use the same version of python as the version used to make the exe (python 3.9). I did easily by changing the python_version in my Pipfile to 3.9 and using pipenv shell.

It's a Pyinstaller binary.(I have used it once before, so I just knew it by checking the file.) Use https://github.com/extremecoders-re/pyinstxtractor to extract its source code archive in binary (by just running python pyinstxtractor.py ./backdoor or something), now many .pyc files are extracted. Find src.pyc and it's malformed as Python3.9, so https://github.com/rocky/python-uncompyle6/ denies to decompile. But challenge information says it's Python3.8, so I write helloworld python script and execute it with Python3.8. It yields Python3.8 .pyc file. Analyze it and find signature is \x55. Change src.pyc's signature from \x61 to \x55 and decompile by running uncompyle6 backdoor-src.38.pyc > backdoor-src.py

If not, you’ll either need to install and use 3.8 to run the program, or you’ll need to help the author continue support beyond 3.8.