decodeBlackHole.py

#!/usr/bin/env python
##
# Decodes obfuscated BlackHole Exploit Kit javascript
# useful for the plugin detection and exploitation pages
##

import re
import os, sys
from StringIO import StringIO


def decode(file_name):
    fin = open(file_name, "r")
    stage_one = fin.read()
    vars = re.compile(r'\".+?\"', re.S)
    bhPat = re.compile(r'[^012a-z3-9]',re.S)
    stage_two = re.search(regex, stage_one)
    parsed = stage_two.group(0)
    o = ''
    for x in re.findinter(vars, stage_two.group(0)):
      o = o + x.group(0)[1:-1]
    o2nd = bhPat.sub( '', o)
    o2nd = StringIO(o2nd)
    stage_three = ''
    while True:
        a = o2nd.read(2)
        if not s:
            break
        stage_three = stage_three + chr(int(a,33))

    outf = open("out.html", 'w')
    outf.write(stage_three)
    out.close()

if __name__ == '__main__':
    try:
        fin = sys.argv[1]
        if not os.path.exists(fin):
            print('[error] unable to locate input file!')
            sys.exit(1)
        decode(fin)
    except IndexError:
        print('usage: ./decode_bhek.py <obfuscated input file>')
        sys.exit(0)