Get download url from mega.nz

megafetch.sh

#!/bin/bash

# Copyright 2018, 2019, 2020 Azure Zanculmarktum
# Copyright 2025 Bijman
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
# permitted provided that the following conditions are met:
#
# 1. Redistributions of this script must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#
#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED
#  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
#  EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
#  OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
#  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Dependencies:
#  openssl

# Usage:
#  $ ./megafetch.sh https://mega.nz/#!abcdefgh!1234567890abcdefghijklmnopqrstuvwxyzABCDEFG
#  http://gfs208n103.userstorage.mega.co.nz/dl/-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890A
#  file.name
#  abcefghijklmnopqrstuvwxyz0123456
#  1234567890abcdef0000000000000000
#  $ wget -O file.name http://gfs208n103.userstorage.mega.co.nz/dl/-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890A
#  $ cat file.name | openssl enc -d -aes-128-ctr -K abcefghijklmnopqrstuvwxyz0123456 -iv 1234567890abcdef0000000000000000 > file.name.new
#  $ mv -f file.name.new file.name

URL=""

# If a URL is passed as an argument, override the default
if [[ $1 =~ ^https?://mega(.co)?\.nz ]]; then
  URL="$1"
fi

# Check if URL is empty
if [[ -z $URL ]]; then
  echo "Usage: ${0##*/} <mega_url>" >&2
  exit 1
fi

CURL="curl -s --fail"

# Check for required commands
missing=false
for cmd in openssl base64 od curl; do
  if ! command -v "$cmd" > /dev/null 2>&1; then
    echo "${0##*/}: $cmd: command not found" >&2
    missing=true
  fi
done
$missing && exit 1

# Extract ID and KEY from URL
if [[ $URL =~ /file/([^#]+)#(.+) ]]; then
  id="${BASH_REMATCH[1]}"
  key="${BASH_REMATCH[2]}"
else
  echo "Invalid MEGA URL format." >&2
  exit 1
fi

# Decode key from base64 to hex
raw_hex=$(echo "$key" | tr '_-' '/+' | base64 -d 2>/dev/null | od -An -tx1 -v | tr -d ' \n')

if [[ ${#raw_hex} -ne 64 ]]; then
  echo "Invalid decoded key length" >&2
  exit 1
fi

# Extract encryption key
k1="${raw_hex:0:16}"
k2="${raw_hex:32:16}"
k3="${raw_hex:16:16}"
k4="${raw_hex:48:16}"

# XOR to get final key
key_hex=$(printf "%016x%016x" "$((0x$k1 ^ 0x$k2))" "$((0x$k3 ^ 0x$k4))")

# Get the download URL
json=$($CURL -H 'Content-Type: application/json' -d '[{"a":"g", "g":1, "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=0&ak=') || exit 1
file_url=$(echo "$json" | grep -o '"g":"[^"]*' | cut -d'"' -f4)

# Get the encrypted file attributes
json=$($CURL -H 'Content-Type: application/json' -d '[{"a":"g", "p":"'"$id"'"}]' 'https://g.api.mega.co.nz/cs?id=1&ak=') || exit 1
at=$(echo "$json" | grep -o '"at":"[^"]*' | cut -d'"' -f4)

# Decrypt attributes
attr_dec=$(echo "$at" | tr '_-' '/+' | base64 -d 2>/dev/null | \
  openssl enc -d -aes-128-cbc -K "$key_hex" -iv 00000000000000000000000000000000 -nopad 2>/dev/null | tr -d '\0')

# Extract file name from decrypted attributes
file_name=$(echo "$attr_dec" | grep -o '"n":"[^"]*' | cut -d'"' -f4)

# Display output info
echo "$file_url"
echo "$file_name"
echo "$key_hex"
echo "${raw_hex:32:16}0000000000000000"

# To actually download and decrypt the file:
# $CURL "$file_url" | openssl enc -d -aes-128-ctr -K "$key_hex" -iv "${raw_hex:32:16}0000000000000000" > "$file_name"