Decrypt obscured rclone password

rclone-deobscure.sh

#!/usr/bin/env bash

# rclone deobscure (bash + openssl)
# Usage:
#   ./deobscure.sh <obscured-string>
#   echo "obscured..." | ./deobscure.sh

set -euo pipefail

KEY_HEX="9c935b48730a554d6bfd7c63c886a92bd390198eb8128afbf4de162b8b95f638"

die(){ echo "error: $*" >&2; exit 1; }

# Read input
if [[ $# -gt 0 ]]; then
  obsc="$1"
else
  obsc="$(cat)"
fi

[[ -n "$obsc" ]] || die "no input"

# base64url -> base64
b64=$(printf '%s' "$obsc" | tr '_-' '/+' | awk '{
  s=$0; m=length(s)%4;
  if(m==2) s=s"==";
  else if(m==3) s=s"=";
  print s
}')

# decode to hex
hex_all=$(printf '%s' "$b64" | base64 -d 2>/dev/null | xxd -p -c 1000000) || die "invalid base64 input"

iv_hex=${hex_all:0:32}
ct_hex=${hex_all:32}

# if no ciphertext, output empty line
if [[ -z "$ct_hex" ]]; then
  echo
  exit 0
fi

# decrypt and always print with trailing newline
printf '%s' "$ct_hex" | xxd -r -p | \
  openssl enc -d -aes-256-ctr -K "$KEY_HEX" -iv "$iv_hex" -nopad 2>/dev/null || die "decryption failed"

echo