python-uncompyle6 VS postman-webex

Q: What is RAPID_API_KEY = os.environ.get('RAPID_API_KEY')? A: You should store configuration in environment variables; never in code. See 12 factors app. Python .pyc files can easily be "decompiled" to .py and reveal all secrets in code.

I was able to figure out that this is a python program which was compiled to an .exe. Using uncompyle6 and pyc2bytecode, I was able to decompile the .exe into the python bytecode...but I'm no expert at reading python bytecode. If you want to do this yourself, note that you will need to use the same version of python as the version used to make the exe (python 3.9). I did easily by changing the python_version in my Pipfile to 3.9 and using pipenv shell.

It's a Pyinstaller binary.(I have used it once before, so I just knew it by checking the file.) Use https://github.com/extremecoders-re/pyinstxtractor to extract its source code archive in binary (by just running python pyinstxtractor.py ./backdoor or something), now many .pyc files are extracted. Find src.pyc and it's malformed as Python3.9, so https://github.com/rocky/python-uncompyle6/ denies to decompile. But challenge information says it's Python3.8, so I write helloworld python script and execute it with Python3.8. It yields Python3.8 .pyc file. Analyze it and find signature is \x55. Change src.pyc's signature from \x61 to \x55 and decompile by running uncompyle6 backdoor-src.38.pyc > backdoor-src.py

If not, you’ll either need to install and use 3.8 to run the program, or you’ll need to help the author continue support beyond 3.8.

Q: What methods can be used to explore the API? A: The best option is to search for Swagger file. Swagger is "open source editor to design, define and document RESTful APIs in the Swagger Specification". Another alternative, is to search for Postman collection for relevant product / service. Some Postman collections examples. For this project, I've used some hacky method: