Laman

How to Deobfusecate Bash Script


A while ago, I came across an interesting bash script. The script that I found is as follows: 

z="
";CFz='z$tz';UFz='z$Hz';ZBz='m'\'';H';jz=';bz=';xCz='='\''il';tCz='kz='\''';jCz='z='\''g';hEz='$Sz$';GDz=''\'' do';WDz='r'\'';y';eBz=';Zz=';SBz='uk'\'';';PCz='hmod';Hz='='\''ap';vEz='z$lz';sDz='='\''/s';XEz='z$Fz';lBz='e :;';kz=''\''pps';IBz='s'\'';T';ODz='='\''go';KEz=';fBz';ABz=''\'';iB';SFz='z$LB';sz='i'\'';V';az='iany';bBz=''\'';WB';KFz='DBz$';bEz='$Kz$';jEz='z$Vz';pz='/v'\'';';YDz='kca'\''';cCz='ab.g';BFz='rz$s';yFz='Bz$j';kDz='; sl';Ez='uz='\''';Gz=''\'';Nz';aDz='='\''pi';EGz='Bz$o';cFz='Rz$N';aCz=''\''aco';TEz=' "$A';aEz='z$Jz';HBz=''\''id/';KBz='t-g'\''';
...
;lFz='Bz$W';CCz=''\''ouc';hCz='ndex';rCz='='\''ex';iCz=''\'';BB';SCz=';KBz';MFz='FBz$';iFz='Bz$T';Vz='ark'\''';CDz='h'\'';m';VDz=''\''/va';IEz='z='\''0';gz='o'\'';P';xDz='z='\''r';tz='capi';NEz='fz='\''';FEz='-'\'';P';iBz=';GBz';dBz='.gi'\''';BEz='='\''an';yCz='.g'\'';';Jz='nz='\''';cz='='\''ar';QEz='='\''kc';HCz='='\''ta';rFz='Bz$c';VEz='$Cz$';HFz='ABz$';sFz='Bz$d';TBz='Xz='\''';pBz='Vz='\''';VCz='JBz=';YFz='$Mz$';uBz=''\''4 /';PBz='ar '\''';DCz='h'\'';q';FBz='&1'\'';';fBz=''\'' 06';yz='d/sl';DDz='z='\''s';OBz='z='\''v';wDz=''\'';YB';KCz='dukc';XCz='0'\'';o';fEz='Pz$Q';aFz='z$Pz';nz=''\'';cz';tFz='Bz$e';FFz='z$xz';XFz='z$Lz';sCz='.p'\'';';Zz='iz='\''';SDz='z='\''w';uFz='Bz$f';iEz='Tz$U';RCz='go.'\''';BCz='OBz=';mz='dir ';
...
mFz='Bz$X';WBz='ps'\'';';bDz='l.'\'';';LEz='='\''es';MBz=''\''ar/';gFz='Bz$R';JFz='CBz$';bCz='r'\'';D';oDz=''\''/di';XDz='z='\''u';UCz='7 '\'';';DFz='$uz$';wBz='app'\''';vDz='cp /';qEz='$ez$';Fz='erv/';RFz='KBz$';UEz='z$Bz';yDz='kab'\''';kBz='ga'\'';';CGz='Bz$m';cBz='z='\''l';tEz='$iz$';FDz=';Cz=';fCz='sd'\'';';uDz='Dz='\''';TDz='w/d'\''';Yz='&>'\'';';jFz='Bz$U';NCz=' /'\'';';rz=''\''w/d';AEz=';XBz';EEz=''\''lot';kEz='$Wz$';EFz='vz$w';YEz='$Gz$';PFz='IBz$';VFz='$Iz$';Wz=';lBz';oBz='b.'\'';';Lz=''\'';nB';iDz=''\''/de';dFz='Bz$O';vCz=''\'';oB';nCz='va'\'';';YCz='r/i'\''';nDz=';Lz=';dz='ka'\'';';ZEz='Hz$I';pCz='shm/';mDz=';mk'\''';DEz='bBz=';Cz='='\''de';ZFz='Nz$O';WEz='Dz$E';Az='z="';bFz='$Qz$';
eval "$Az$z$Bz$Cz$Dz$Ez$Fz$Gz$Hz$Iz$Jz$Kz$Lz$Mz$Nz$Oz$Pz$Qz$Rz$Sz$Tz$Uz$Vz$Wz$Xz$Yz$Zz$az$bz$cz$dz$ez$fz$gz$hz$iz$jz$kz$lz$Rz$mz$nz$oz$pz$qz$rz$sz$Rz$tz$uz$vz$wz$xz$yz$ABz$BBz$CBz$DBz$EBz$FBz$GBz$HBz$IBz$JBz$KBz$LBz$MBz$NBz$OBz$PBz$QBz$RBz$SBz$TBz$UBz$VBz$Hz$WBz$XBz$YBz$ZBz$Rz$aBz$bBz$cBz$dBz$eBz$fBz$gBz$Mz$hBz$iBz$jBz$kBz$Rz$lBz$mBz$nBz$oBz$pBz$qBz$rBz$JBz$sBz$tBz$uBz$vBz$Mz$wBz$xBz$yBz$ACz$BCz$CCz$DCz$ECz$FCz$GCz$HCz$ICz$JCz$KCz$LCz$MCz$NCz$OCz$PCz$QCz$ECz$RCz$SCz$TCz$UCz$VCz$WCz$XCz$JBz$YCz$ZCz$aCz$bCz$Rz$cCz$dCz$eCz$fCz$gCz$hCz$iCz$jCz$kCz$lCz$mCz$nCz$oCz$pCz$qCz$rCz$sCz$tCz$uCz$vCz$cBz$wCz$xCz$yCz$ADz$BDz$CDz$DDz$EDz$FDz$GDz$HDz$DDz$IDz$JDz$KDz$LDz$Rz$MDz$NDz$ODz$PDz$QDz$GDz$RDz$SDz$TDz$UDz$VDz$WDz$XDz$YDz$ZDz$aDz$bDz$cDz$dDz$eDz$fDz$gDz$hDz$iDz$jDz$Rz$kDz$lDz$Mz$mDz$nDz$oDz$pDz$OBz$qDz$rDz$sDz$tDz$uDz$vDz$wDz$xDz$yDz$AEz$BEz$CEz$DEz$EEz$FEz$Rz$GEz$HEz$IEz$JEz$KEz$LEz$MEz$NEz$OEz$PEz$QEz$REz$z$SEz$TEz$UEz$VEz$WEz$XEz$YEz$ZEz$aEz$bEz$cEz$dEz$eEz$fEz$gEz$hEz$iEz$jEz$kEz$lEz$mEz$nEz$oEz$pEz$qEz$rEz$sEz$tEz$uEz$vEz$wEz$xEz$yEz$AFz$BFz$CFz$DFz$EFz$FFz$GFz$HFz$IFz$JFz$KFz$LFz$MFz$NFz$OFz$PFz$QFz$RFz$ZEz$aEz$bEz$cEz$dEz$eEz$fEz$gEz$hEz$iEz$SFz$TFz$UFz$VFz$WFz$XFz$YFz$ZFz$aFz$bFz$cFz$dFz$eFz$fFz$gFz$hFz$iFz$jFz$kFz$lFz$mFz$nFz$oFz$pFz$qFz$rFz$sFz$tFz$uFz$vFz$wFz$xFz$yFz$AGz$BGz$CGz$DGz$EGz$FGz"

The script is written in bash and is very long. From the variables listed, you could say the script has been obfuscated. So it is necessary to decode the script so that we know what the system will do when the script is executed. 

So I did a little research on how to deobfuscate bash scripts, and I found something in a post on stackoverflow (All hail stackoverflow!!!).

Here's how to deobfuscate in bash: