使用shc加密bash腳本程序

SHC表明shell script compiler，即shell腳本編譯器。經過SHC編譯過的腳本程序對普通用戶而言是不讀的，所以若是你想保護你的代碼（例如含有密鑰），則能夠考慮SHC；然而有些人能夠經過反向編譯的方式破解SHC加密過的腳本。
下面咱們開始介紹:

1、使用SHC加密bash腳本程序
1.下載並編譯SHC
# wget http://www.datsi.fi.upm.es/~frosal/sources/shc-3.8.7.tgz
# tar xvfz shc-3.8.7.tgz
# cd shc-3.8.7
# make
你能夠在SHC官方網站找到其最新源代碼。
如今咱們驗證SHC是否正確安裝：
$ ./shc -v
shc parse(-f): No source file specified

shc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script
2.創建一個測試bash腳本
#!/bin/bash

echo -n "How many random numbers do you want to generate? "
read max

for (( start = 1; start <= $max; start++ ))
do
  echo -e $RANDOM
done
3.使用SHC加密bash腳本
$ ./shc -f random.sh
以後咱們能夠看到多出兩個文件：
$ ll random.sh*
-rwxr-xr-x 1 lesca lesca   153 2012-05-16 06:34 random.sh*
-rwx--x--x 1 lesca lesca 10512 2012-05-16 06:34 random.sh.x*
-rw-r--r-- 1 lesca lesca 10145 2012-05-16 06:34 random.sh.x.c
• random.sh 是原始的未加密的bash腳本
• random.sh.x 是加密的二進制格式的bash腳本
• random.sh.x.c 是random.sh的C源代碼。該文件是從random.sh轉換而來的，SHC就是經過將bash腳本轉爲C語言再編譯之進行加密的。
$ file random.sh*
random.sh:     Bourne-Again shell script text executable
random.sh.x:   ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, stripped
random.sh.x.c: ASCII C program text
4.執行加密的bash腳本
$ ./random.sh.x
How many random numbers do you want to generate? 3
15146
20741
17825
2、SHC的其餘功能
1.設置腳本使用期限
咱們能夠經過SHC指定程序的有效期，過時後程序將失效，任未嘗試運行的用戶將收到錯誤消息。SHC使用-e dd/mm/yyyy來開啓該功能：
$ ./shc -e 31/12/2011 -f random.sh
若是程序過時了，將會獲得如下消息：
$ ./random.sh.x
./random.sh.x: has expired!
Please contact your provider
結合-m "message"選項，咱們能夠指定發生錯誤時輸出的消息：
$ ./shc -e 31/12/2011 -m "Contact admin@lesca.me for new version of this script" -f random.sh

$ ./random.sh.x
./random.sh.x: has expired!
Contact admin@lesca.me for new version of this script
2.建立可重複發佈的加密腳本
• -r: 容許該腳本在同操做系統的不一樣硬件平臺上運行
• -T: 容許讓ltrace, strace那樣的程序追蹤腳本運行
• -v: 輸出詳細信息
一般-r與-T一塊兒使用，用於建立可重複發佈且可追蹤的加密腳本，例如：
$ ./shc -v -r -T -f random.sh
shc shll=bash
shc [-i]=-c
shc [-x]=exec '%s' "$@"
shc [-l]=
shc opts=
shc: cc  random.sh.x.c -o random.sh.x
shc: strip random.sh.x
shc: chmod go-r random.sh.x

$ ./random.sh.x
How many random numbers do you want to generate? 3
1311
19637
14891

 

 

 

Q: How do I encrypt my bash shell script on Linux environment? The shell script contains password, and I don’t want others who have execute access to view the shell script and get the password. Is there a way to encrypt my shell script?

A: First, as a best practice you should not be encrypting your shell script. You should really document your shell script properly so that anybody who views it understands exactly what it does. If it contains sensitive information like password, you should figure out a different approach to write the shell script without having to encrypt it.
That being said, if you still insist on encrypting a shell script, you can use SHC utility as explained below. Please note that encrypted shell script created by shc is not readable by normal users. However someone who understands how this works can extract the original shell script from the encrypted binary created by shc.
SHC stands for shell script compiler.
1. Download shc and install it
Download shc and install it as shown below.
# wget http://www.datsi.fi.upm.es/~frosal/sources/shc-3.8.7.tgz
# tar xvfz shc-3.8.7.tgz
# cd shc-3.8.7
# make
Verify that shc is installed properly.
$ ./shc -v
shc parse(-f): No source file specified

shc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script
2. Create a Sample Shell Script
Create a sample bash shell script that you like to encrypt using shc for testing purpose.
For testing purpose, let us create the following random.sh shell script which generates random numbers. You have to specify how many random numbers you like to generate.
$ vi random.sh
#!/bin/bash

echo -n "How many random numbers do you want to generate? "
read max

for (( start = 1; start <= $max; start++ ))
do
  echo -e $RANDOM
done

$ ./random.sh
How many random numbers do you want to generate? 3
24682
1678
491
3. Encrypt the Shell Script Using shc
Encrypt the random.sh shell scripting using shc as shown below.
$ ./shc -f random.sh
This will create the following two files:
$ ls -l random.sh*
-rwxrw-r--. 1 ramesh ramesh   149 Mar 27 01:09 random.sh
-rwx-wx--x. 1 ramesh ramesh 11752 Mar 27 01:12 random.sh.x
-rw-rw-r--. 1 ramesh ramesh 10174 Mar 27 01:12 random.sh.x.c
• random.sh is the original unencrypted shell script
• random.sh.x is the encrypted shell script in binary format
• random.sh.x.c is the C source code of the random.sh file. This C source code is compiled to create the above encrypted random.sh.x file. The whole logic behind the shc is to convert the random.sh shell script to random.sh.x.c C program (and of course compile that to generate the random.sh.x executable)
$ file random.sh
random.sh: Bourne-Again shell script text executable

$ file random.sh.x
random.sh.x: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped

$ file random.sh.x.c
random.sh.x.c: ASCII C program text
4. Execute the Encrypted Shell Script
Now, let us execute the encrypted shell script to make sure it works as expected.
$ ./random.sh.x
How many random numbers do you want to generate? 3
7489
10494
29627
Please note that the binary itself is still dependent on the shell (the first line provided in the random.sh. i.e /bin/bash) to be available to execute the script.
5. Specifying Expiration Date for Your Shell Script
Using shc you can also specify an expiration date. i.e After this expiration date when somebody tries to execute the shell script, they'll get an error message.
Let us say that you don't want anybody to execute the random.sh.x after 31-Dec-2011 (I used last year date for testing purpose).
Create a new encrypted shell script using "shc -e" option to specify expiration date. The expiration date is specified in the dd/mm/yyyy format.
$ ./shc -e 31/12/2011 -f random.sh
In this example, if someone tries to execute the random.sh.x, after 31-Dec-2011, they'll get a default expiration message as shown below.
$ ./random.sh.x
./random.sh.x: has expired!
Please contact your provider
If you like to specify your own custom expiration message, use -m option (along with -e option as shown below).
$ ./shc -e 31/12/2011 -m "Contact admin@thegeekstuff.com for new version of this script" -f random.sh

$ ./random.sh.x
./random.sh.x: has expired!
Contact admin@thegeekstuff.com for new version of this script
6. Create Redistributable Encrypted Shell Scripts
Apart from -e, and -m (for expiration), you can also use the following options:
• -r will relax security to create a redistributable binary that executes on other systems that runs the same operating system as the one on which it was compiled.
• -T will allow the created binary files to be traceable using programs like strace, ltrace, etc.
• -v is for verbose
Typically you might want to use both -r and -T option to craete a redistributable and tracable shell encrypted shell script as shown below.
$ ./shc -v -r -T -f random.sh
shc shll=bash
shc [-i]=-c
shc [-x]=exec '%s' "$@"
shc [-l]=
shc opts=
shc: cc  random.sh.x.c -o random.sh.x
shc: strip random.sh.x
shc: chmod go-r random.sh.x

$ ./random.sh.x How many random numbers do you want to generate? 3 28954 1410 15234 Finally, it is worth repeating again: You should not be encrypting your shell script in the first place. But, if you decided to encrypt your shell script using shc, please remember that a smart person can still generate the original shell script from the encrypted binary that was created by shc.