快捷導(dǎo)航

shell腳本加密工具shc使用詳解

更新時(shí)間：2021年06月28日 10:02:47 作者：西京刀客

Linux下的shell腳本用途廣泛，經(jīng)常包含IP、Pwd等關(guān)鍵信息，可讀可寫(xiě)的特點(diǎn)很容易造成信息泄露，導(dǎo)致嚴(yán)重后果。基于這些原因，對(duì)腳本實(shí)施加密便變得很有必要。本文介紹shell腳本加密工具應(yīng)用場(chǎng)景分析，一起看看吧

shell腳本加密工具shc

shc是一個(gè)加密shell腳本的工具.它的作用是把shell腳本轉(zhuǎn)換為一個(gè)可執(zhí)行的二進(jìn)制文件.

應(yīng)用場(chǎng)景

用shell腳本對(duì)系統(tǒng)進(jìn)行自動(dòng)化維護(hù),簡(jiǎn)單,便捷而且可移植性好.但shell腳本是可讀寫(xiě)的,很有可能會(huì)泄露敏感信息,如用戶(hù)名,密碼,路徑,IP等.

對(duì)于腳本中含有一些敏感信息的，通常我們都想做成二進(jìn)制程序，不讓用戶(hù)看到源碼，對(duì)于有這種需求的通常我們一般采用shc或者gzexe，我個(gè)人還是比較推薦shc。

shc 安裝和使用

yum -y install shc 或 apt install shc

我們隨便寫(xiě)一個(gè)腳本

# cat test.sh
#!/bin/bash

echo "this is shc test"

用shc加密

shc -r -v -f test.sh

shc -r -f script-name 注意:要有-r選項(xiàng), -f 后跟要加密的腳本名.

# ls -l
total 36
-rw-r--r-- 1 root root    37 12月 20 21:48 test.sh
-rwx--x--x 1 root root 11160 12月 20 21:48 test.sh.x
-rw-r--r-- 1 root root  9433 12月 20 21:48 test.sh.x.c

加密后會(huì)生成二個(gè)文件
test.sh 源文件
test.sh.x 加密后二進(jìn)制文件
test.sh.x.c 腳本對(duì)應(yīng)的C語(yǔ)言版本源碼

執(zhí)行一下加密后文件

# ./test.sh.x
this is shc test

shc解密

市面上面現(xiàn)在有對(duì)應(yīng)的unshc解密程序，我們直接去github看看

https://github.com/yanncam/UnSHc/
支持x86 mips arm架構(gòu)CPU
但對(duì)于我測(cè)試結(jié)果對(duì)于x86支持應(yīng)該是最好的，作者自己維護(hù)的，其它的是第三方個(gè)人維護(hù)，兼容性不好。

 # ./unshc.sh /tmp/test.sh.x  -o test.txt
 _   _       _____ _   _
| | | |     /  ___| | | |
| | | |_ __ \ `--.| |_| | ___
| | | | '_ \ `--. \  _  |/ __|
| |_| | | | /\__/ / | | | (__
 \___/|_| |_\____/\_| |_/\___|

--- UnSHc - The shc decrypter.
--- Version: 0.8
------------------------------
UnSHc is used to decrypt script encrypted with SHc
Original idea from Luiz Octavio Duarte (LOD)
Updated and modernized by Yann CAM
- SHc   : [http://www.datsi.fi.upm.es/~frosal/]
- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]
------------------------------

[*] Input file name to decrypt [/tmp/test.sh.x]
[+] Output file name specified [test.txt]
[+] ARC4 address call candidate : [0x400d06]
[*] Extracting each args address and size for the 14 arc4() calls with address [0x400d06]...
	[0] Working with var address at offset [0x602179] (0x2a bytes)
	[1] Working with var address at offset [0x602121] (0x1 bytes)
	[2] Working with var address at offset [0x602319] (0xa bytes)
	[3] Working with var address at offset [0x602170] (0x3 bytes)
	[4] Working with var address at offset [0x6020e0] (0xf bytes)
	[5] Working with var address at offset [0x602141] (0x1 bytes)
	[6] Working with var address at offset [0x602127] (0x16 bytes)
	[7] Working with var address at offset [0x602144] (0x16 bytes)
	[8] Working with var address at offset [0x60215d] (0x13 bytes)
	[9] Working with var address at offset [0x6021ad] (0x1 bytes)
	[10] Working with var address at offset [0x6021ae] (0x1 bytes)
	[11] Working with var address at offset [0x6020f9] (0x26 bytes)
	[12] Working with var address at offset [0x6021b3] (0x13 bytes)
	[13] Working with var address at offset [0x6021c8] (0x13 bytes)
[*] Extracting password...
	[+] PWD address found : [0x6021ec]
	[+] PWD size found : [0x100]
[*] Executing [/tmp/MYoKED] to decrypt [/tmp/test.sh.x]
[*] Retrieving initial source code in [test.txt]
[*] All done!
root@Develop:~/UnSHc-master/latest# cat test.txt
#!/bin/bash

echo "this is shc test"