devbox
Gausst松鼠会
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Linux shell加密解密方法（gzexe、shc）_shell脚本解密

作者：Gausst松鼠会 | 2024-04-04 22:14:38

赞

踩

shell脚本解密

一、系统自带gzexe

gzexe无需安装任何软件，是linux自带的功能，只需要执行命令即可，我们可以利用wget将文件放在root目录下，也可以通过sftp放在root目录，也可以直接利用cd命令选择任意目录

加密方法

假如说我们当前目录下有个脚本名字叫test.sh
那我们就执行下面的方法进行加密

gzexe test.sh

此时在目录下就会产生一个test.sh~文件，该文件是源文件，test.sh是加密后的文件
（注意：执行加密的文件跟执行源文件没有区别）

解密方法

假如说我们这个脚本名字叫test.sh
那我们就执行如下命令进行解密

gzexe -d test.sh

同上，在目录下就会产生一个test.sh~文件，该文件是源文件，test.sh是解密后的文件

二、shc加密软件

shc是linux的一款加密脚本的插件,东西比较安全,shc官网:http://www.datsi.fi.upm.es/%7Efrosal/

安装方法

执行如下脚本安装shc

  1. wget https://www.datsi.fi.upm.es/%7Efrosal/sources/shc-3.8.9.tgz
  2.  
  3. tar vxf shc-3.8.9.tgz
  4.  
  5. cd shc-3.8.9
  6.  
  7. mkdir -p /usr/local/man/man1 
  8.  
  9. make install

如果不执行mkdir -p /usr/local/man/man1将会报如下错误

*** Installing shc and shc.1 on /usr/local *** ?Do you want to continue? y install -c -s shc /usr/local/bin/ install -c -m 644 shc.1 /usr/local/man/man1/ install: target `/usr/local/man/man1/’ is not a directory: No such file or directory make: *** [install] Error 1

shc常用参数：

-e date （指定过期日期）

-m message （指定过期提示的信息）

-f script_name（指定要编译的shell的路径及文件名）

-r Relax security. （可以相同操作系统的不同系统中执行）

-v Verbose compilation（编译的详细情况）

加密方法

假如说我们这个脚本名字叫test.sh

那我们就执行如下命令进行加密

shc -v -f test.sh

-v 是现实加密过程

-f 后面跟需要加密的文件

abc.sh.x为加密后的二进制文件，赋予执行权限后，可直接执行。更改名字mv vpsps.sh.x vpspscom.sh

abc.sh.x.c 是c源文件。基本没用，可以删除

过期加密法

另shc还提供了一种设定有效执行期限的方法，过期时间，如：

# shc -e 14/09/2016 -m -f test.sh

选项“-e”指定过期时间，格式为“日/月/年”；选项“-m”指定过期后执行此Shell程序的提示信息。

如果在过期后执行，则会有如下提示：

  1. # ./abc.sh.x
  2.  
  3. ./abc.sh.x: has expired!（文件已经过期）

使用以上方法要注意，需防止用户更改系统时间，可以通过在程序中加入自动更新系统时间的命令来解决此问题。测试都已通过！

解密方法

利用unshc来解密
网址：https://github.com/yanncam/UnSHc/

unshc使用方法

将unshc wget或者上传到任意目录
然后可执行如下命令查看帮助

./unshc.sh -h

执行下面的命令进行解密（此过程可能耗时有点长，需耐心等待）

./unshc.sh script.sh.x -o script_decrypted.sh

script.sh.x文件为经过加密的二进制文件 script_decrypted.sh文件为解密后shell脚本

github.com/yanncam/UnSHc/blob/master/release/0.8/unshc-v0.8.sh

可以将下面的代码保存成unshc.sh文件即可，给可执行权限后（chmod 777 unshc.sh），直接使用

  1. #!/bin/bash
  2. ###################
  3. # Author: Luiz Otavio Duarte a.k.a. (LOD)
  4. #  11/03/08 - v0.1
  5. # Updated: Yann CAM v0.2 - yann.cam@gmail.com | www.asafety.fr
  6. #  06/27/13 - v0.2
  7. #  -- Adding new objdump format (2.22) to retrieve data (especially on Ubuntu distribution)
  8. #  -- Patch few regex with sorted address list
  9. # Updated: Yann CAM v0.3 - yann.cam@gmail.com | www.asafety.fr
  10. #  18/11/15 - v0.3
  11. #  -- Adapt script for new architecture
  12. #  -- Clean and optimize functions
  13. #  -- Add an (unsigned long) cast in shc C source code
  14. # Updated: Yann CAM v0.4 - yann.cam@gmail.com | www.asafety.fr
  15. #  14/12/15 - v0.4
  16. #  -- Comment specific return statement in C source
  17. # Updated: Yann CAM v0.5 - yann.cam@gmail.com | www.asafety.fr
  18. #  15/12/15 - v0.5
  19. #  -- Patch extract arc4 function to keep the latest offset only
  20. # Updated: Yann CAM v0.6 - yann.cam@gmail.com | www.asafety.fr
  21. #  16/12/15 - v0.6
  22. #  -- Add bash script options (getopts)
  23. # Updated: Yann CAM v0.7 - yann.cam@gmail.com | www.asafety.fr
  24. #  07/28/16 - v0.7
  25. #  -- Add support of multiple ARC4 offsets auto-retrieved by script (iterate over each one), specialy for huge bash file encrypted
  26. #  -- Force .sh extension to decrypted file, for initial file without extension (prevent rewrite of original file)
  27. # Updated: Yann CAM v0.8 - yann.cam@gmail.com | www.asafety.fr
  28. #  01/23/17 - v0.8
  29. #  -- Adjust grep for retrieve PWD_SIZE in OBJDUMP to ignore movb instruction (https://github.com/yanncam/UnSHc/issues/12)
  30. ###################
  31. # Tested on :
  32. #  Ubuntu 14.04.3 LTS x86_64
  33. #    Linux server 3.13.0-61-generic #100-Ubuntu SMP Wed Jul 29 11:21:34 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  34. #    Linux version 3.13.0-61-generic (buildd@lgw01-50) (gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) ) #100-Ubuntu SMP Wed Jul 29 11:21:34 UTC 2015
  35. #
  36. #  CentOS release 6.6 (Final) x86_64
  37. #    Linux server 2.6.32-504.23.4.el6.x86_64 #1 SMP Tue Jun 9 20:57:37 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  38. #    Linux version 2.6.32-504.23.4.el6.x86_64 (mockbuild@c6b9.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC) ) #1 SMP Tue Jun 9 20:57:37 UTC 2015
  39. #
  40. #  Debian 7.8 i686
  41. #    Linux server 3.2.0-4-686-pae #1 SMP Debian 3.2.68-1+deb7u2 i686 GNU/Linux
  42. #    Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.68-1+deb7u2
  43. ###################
  44. VERSION="0.8"
  45.  
  46. OBJDUMP=`which objdump`
  47. GREP=`which grep`
  48. CUT=`which cut`
  49. SHRED=`which shred`
  50. UNIQ=`which uniq`
  51. SORT=`which sort`
  52. GCC=`which gcc`
  53. WC=`which wc`
  54. AWK=`which awk`
  55. SED=`which sed`
  56. TR=`which tr`
  57. HEAD=`which head`
  58. TAIL=`which tail`
  59.  
  60. BINARY=""
  61. TMPBINARY=$(mktemp /tmp/XXXXXX)
  62. DUMPFILE=""
  63. STRINGFILE=""
  64. CALLFILE=$(mktemp /tmp/XXXXXX)
  65. CALLADDRFILE=$(mktemp /tmp/XXXXXX)
  66. CALLSIZEFILE=$(mktemp /tmp/XXXXXX)
  67.  
  68. declare -A LISTOFCALL
  69.  
  70. # Variable to know the index of variables.
  71. # This var is to loop on each 14 arc4() call with ordered args.
  72. j=0
  73.  
  74. # Simple usage help / man
  75. function usage(){
  76.         printf "[*] Usage : $0 [OPTIONS] <file.sh.x>\n"
  77.         printf "\t -h | --help                          : print this help message\n"
  78.         printf "\t -a OFFSET | --arc4 OFFSET            : specify the arc4() offset arbitrarily (without 0x prefix)\n"
  79.         printf "\t -d DUMPFILE | --dumpfile DUMPFILE    : provide an object dump file (objdump -D script.sh.x > DUMPFILE)\n"
  80.         printf "\t -s STRFILE | --stringfile STRFILE    : provide a string dump file (objdump -s script.sh.x > STRFILE)\n"
  81.         printf "\t -o OUTFILE | --outputfile OUTFILE    : indicate the output file name\n\n"
  82.         printf "[*] e.g : \n"
  83.         printf "\t$0 script.sh.x\n"
  84.         printf "\t$0 script.sh.x -o script_decrypted.sh\n"
  85.         printf "\t$0 script.sh.x -a 400f9b\n"
  86.         printf "\t$0 script.sh.x -d /tmp/dumpfile -s /tmp/strfile\n"
  87.         printf "\t$0 script.sh.x -a 400f9b -d /tmp/dumpfile -s /tmp/strfile -o script_decrypted.sh\n"
  88. }
  89.  
  90. # Clean all temp file created for this script
  91. function clean(){
  92.         $SHRED -zu -n 1 $DUMPFILE $CALLFILE $CALLADDRFILE $CALLSIZEFILE $STRINGFILE $TMPBINARY ${TMPBINARY}.c >/dev/null 2>&1
  93. }
  94.  
  95. # Clean error exit function after cleaning temp file
  96. function exit_error(){
  97.         clean
  98.         exit 1;
  99. }
  100.  
  101. # Check the availability of basic commands usefull for this script
  102. function check_binaries() {
  103.         if [ ! -x ${OBJDUMP} ]; then
  104.                 echo "[-] Error, cannot execute or find objdump binary"
  105.                 exit_error
  106.         fi
  107.         if [ ! -x ${GREP} ]; then
  108.                 echo "[-] Error, cannot execute or find grep binary"
  109.                 exit_error
  110.         fi
  111.         if [ ! -x ${CUT} ]; then
  112.                 echo "[-] Error, cannot execute or find cut binary"
  113.                 exit_error
  114.         fi
  115.         if [ ! -x ${SHRED} ]; then
  116.                 echo "[-] Error, cannot execute or find shred binary"
  117.                 exit_error
  118.         fi
  119.         if [ ! -x ${UNIQ} ]; then
  120.                 echo "[-] Error, cannot execute or find uniq binary"
  121.                 exit_error
  122.         fi
  123.         if [ ! -x ${SORT} ]; then
  124.                 echo "[-] Error, cannot execute or find sort binary"
  125.                 exit_error
  126.         fi
  127.         if [ ! -x ${GCC} ]; then
  128.                 echo "[-] Error, cannot execute or find gcc binary"
  129.                 exit_error
  130.         fi
  131.         if [ ! -x ${WC} ]; then
  132.                 echo "[-] Error, cannot execute or find wc binary"
  133.                 exit_error
  134.         fi
  135. }
  136.  
  137. # Create dump files of encrypted script
  138. function generate_dump() {
  139.         # DUMPFILE dump to retrive arc4 address, address and size of each arc4 arguments and pwd
  140.         $OBJDUMP -D $BINARY > "$DUMPFILE"
  141.         # STRINGFILE dump to retrieve pwd and arc4 argument
  142.         $OBJDUMP -s $BINARY > "$STRINGFILE"
  143. }
  144.  
  145. # Find out the most called function. This function is arc4() and there are 14 calls.
  146. # Update 27/06/2013 : Regexps updated to match new objdump format and retrieve the $CALLADDR from his number of call (bug initial with "sort")
  147. # Update 16/11/2015 : Adding new architecture support
  148. # Update 28/07/2016 : Adding multiple ARC4 offsets support (loop on each candidate)
  149. function extract_arc4_call_addr(){
  150. 	TAILNUMBER=$1
  151. 	CALLADDRS=$($GREP -Eo "call.*[0-9a-f]{6,}" $DUMPFILE | $GREP -Eo "[0-9a-f]{6,}" | $SORT | $UNIQ -c | $SORT | $GREP -Eo "(14).*[0-9a-f]{6,}" | $GREP -Eo "[0-9a-f]{6,}")
  152. 	TAILMAX=`wc -l <<< "$CALLADDRS"`
  153.         CALLADDR=$(echo $CALLADDRS | $SED "s/ /\n/g" | $TAIL -n $TAILNUMBER | $HEAD -n 1)
  154.         if [[ -z "$CALLADDR" || $TAILNUMBER -gt $TAILMAX ]]; then
  155.            echo "[-] Unable to define arc4() call address..."
  156.            exit_error
  157.         fi
  158.         echo "[+] ARC4 address call candidate : [0x$CALLADDR]"
  159. }
  160.  
  161. # Extract each args values of arc4 calls
  162. function extract_variables_from_binary(){
  163.         echo "[*] Extracting each args address and size for the 14 arc4() calls with address [0x$CALLADDR]..."
  164.         # Initialize the number of line before CALLADDR to looking for addresses of args
  165.         i=2
  166.         # Retrieve ordered list of address var and put it to $CALLADDRFILE
  167.         while [[ $($WC -l < $CALLADDRFILE) -ne 14 ]]; do
  168.                 $GREP -B $i "call.*$CALLADDR" $DUMPFILE | $GREP -v "$CALLADDR" | $GREP -Eo "(0x[0-9a-f]{6,})" > $CALLADDRFILE
  169.                 i=$(($i + 1))
  170.                 if [ $i -eq 10 ]; then
  171.                         echo "[-] Unable to extract addresses of 14 arc4 args with ARC4 address call [0x$CALLADDR]..."
  172.                         return;
  173.                 fi
  174.         done
  175.  
  176.         # Initialize the number of line before CALLADDR to looking for sizes of args
  177.         i=3
  178.         # Retrieve ordered list of size var and append it to $CALLSIZEFILE
  179.         while [[ $($WC -l < $CALLSIZEFILE) -ne 14 ]]; do
  180.                 $GREP -B $i "call.*$CALLADDR" $DUMPFILE | $GREP -v "$CALLADDR" | $GREP -Eo "(0x[0-9a-f]+,)" | $GREP -Eo "(0x[0-9a-f]+)" | $GREP -Ev "0x[0-9a-f]{6,}" > $CALLSIZEFILE
  181.                 i=$(($i + 1))
  182.                 if [ $i -eq 10 ]; then
  183.                         echo "[-] Unable to extract sizes of 14 arc4 args with ARC4 address call [0x$CALLADDR]..."
  184.                         return;
  185.                 fi
  186.         done
  187.  
  188.         # For each full address in $CALLADDRFILE and corresponding size in $CALLSIZEFILE
  189.         IFS=$'\n' read -d '' -r -a LISTOFADDR < $CALLADDRFILE
  190.         IFS=$'\n' read -d '' -r -a LISTOFSIZE < $CALLSIZEFILE
  191.         for (( x = 0; x < ${#LISTOFADDR[*]}; x = x+1 ))
  192.         do
  193.                 i=${LISTOFADDR[$x]}
  194.                 NBYTES=${LISTOFSIZE[$x]}
  195.         echo -e "\t[$x] Working with var address at offset [$i] ($NBYTES bytes)"
  196.         # Some diferences in assembly.
  197.         # We can have:
  198.         #  mov <adr>,%eax
  199.         #  push 0x<hex>
  200.         #  push %eax
  201.         #  call $CALLADDR
  202.         #
  203.         #  or
  204.         #
  205.         #  push 0x<hex>
  206.         #  push 0x<adr>
  207.         #  call $CALLADDR
  208.         #
  209.         # UPDATE 27/06/2013 :
  210.         # Adding support of objdump format
  211.         # New format supported (Debian 7 x86) :
  212.         #
  213.         #  movl   $0x<hex>,0x4(%esp)
  214.         #
  215.         #  movl   $0x<adr>,(%esp)
  216.         #  call   $CALLADDR
  217.         #
  218.         # UPDATE 18/11/2015 :
  219.         # Adding support of objdump format
  220.         # Ubuntu 14.04 LTS x86_64
  221.         #
  222.         #  mov    $0x<hex>,%esi
  223.         #  mov    $0x<adr>,%edi
  224.         #  callq  $CALLADDR <fork@plt+0x23b>
  225.         #
  226.  
  227.         # Key is the address with the variable content.
  228.         KEY=$(echo $i | $CUT -d 'x' -f 2)
  229.  
  230.         # A 2 bytes variable (NBYTES > 0) can be found like this: (in STRINGFILE)
  231.         # ---------------X
  232.         # X---------------
  233.         #
  234.         # So we need 2 lines from STRINGFILE to make it all correct. So:
  235.         NLINES=$(( ($NBYTES / 16) +2 ))
  236.  
  237.         # All line in STRINGFILE starts from 0 to f. So LASTBIT tells me the index in the line to start recording.
  238.         let LASTBYTE="0x${KEY:$((${#KEY}-1))}"
  239.  
  240.         # Grep all lines needed from STRINGFILE, merge lines.
  241.         STRING=$( $GREP -A $(($NLINES-1)) -E "^ ${KEY:0:$((${#KEY}-1))}0 " $STRINGFILE | $AWK '{ print $2$3$4$5}' | $TR '\n' 'T' | $SED -e "s:T::g")
  242.  
  243.         # Change string to begin in the line index.
  244.         STRING=${STRING:$((2*$LASTBYTE))}
  245.         # Cut the string to the number off bytes of the variable.
  246.         STRING=${STRING:0:$(($NBYTES * 2))}
  247.  
  248.         # We need to convert to a \x??\x?? structure so:
  249.         FINALSTRING=""
  250.         for ((i = 0; i < $((${#STRING} /2 )); i++)); do
  251.                         FINALSTRING="${FINALSTRING}\x${STRING:$(($i * 2)):2}"
  252.         done
  253.  
  254.         define_variable
  255.    done
  256. }
  257.  
  258. # arc4 function is called 14 times in the C code.
  259. # Each call is done with the same args sequence even if their declaration is randomized :
  260. # msg1, date, shll, inlo, xecc, lsto, tst1, chk1, msg2, rlax, opts, text, tst2 and chk2.
  261. function define_variable() {
  262.    case "$j" in
  263.    0)   VAR_MSG1=$FINALSTRING
  264.                 VAR_MSG1_Z=$NBYTES;;
  265.    1)   VAR_DATE=$FINALSTRING
  266.                 VAR_DATE_Z=$NBYTES;;
  267.    2)   VAR_SHLL=$FINALSTRING
  268.                 VAR_SHLL_Z=$NBYTES;;
  269.    3)   VAR_INLO=$FINALSTRING
  270.                 VAR_INLO_Z=$NBYTES;;
  271.    4)   VAR_XECC=$FINALSTRING
  272.                 VAR_XECC_Z=$NBYTES;;
  273.    5)   VAR_LSTO=$FINALSTRING
  274.                 VAR_LSTO_Z=$NBYTES;;
  275.    6)   VAR_TST1=$FINALSTRING
  276.                 VAR_TST1_Z=$NBYTES;;
  277.    7)   VAR_CHK1=$FINALSTRING
  278.                 VAR_CHK1_Z=$NBYTES;;
  279.    8)   VAR_MSG2=$FINALSTRING
  280.                 VAR_MSG2_Z=$NBYTES;;
  281.    9)   VAR_RLAX=$FINALSTRING
  282.                 VAR_RLAX_Z=$NBYTES;;
  283.    10)  VAR_OPTS=$FINALSTRING
  284.                 VAR_OPTS_Z=$NBYTES;;
  285.    11)  VAR_TEXT=$FINALSTRING
  286.                 VAR_TEXT_Z=$NBYTES;;
  287.    12)  VAR_TST2=$FINALSTRING
  288.                 VAR_TST2_Z=$NBYTES;;
  289.    13)  VAR_CHK2=$FINALSTRING
  290.                 VAR_CHK2_Z=$NBYTES;;
  291.    esac
  292.    j=$(($j + 1))
  293. }
  294.  
  295.  
  296. # The password is used in the key function right before first call to arc4.
  297. # So we need the previous call just before the first "call ARC4_CALLADDR" and its args.
  298. # Update 27/06/2013 : Add new objdump format
  299. # Update 18/11/2015 : Simplify extraction
  300. # Update 23/01/2017 : Ignore movb instruction
  301. function extract_password_from_binary(){
  302.         echo "[*] Extracting password..."
  303.         KEY_ADDR=""
  304.         KEY_SIZE=""
  305.  
  306.         # Initialize the number of line before CALLADDR to watch
  307.         i=5
  308.         while [[ ( -z "$KEY_ADDR" ) || ( -z "$KEY_SIZE" ) ]]; do
  309.                 $GREP -B $i -m 1 "call.*$CALLADDR" $DUMPFILE | $GREP -v $CALLADDR > $CALLFILE
  310.                 #cat $CALLFILE
  311.                 # Adjust these two next line to grep right addr & size value (depending on your architecture)
  312.                 KEY_ADDR=$($GREP -B 3 -m 1 "call" $CALLFILE | $GREP mov | $GREP -oE "0x[0-9a-z]{6,}+" | $HEAD -n 1)
  313.                 KEY_SIZE=$($GREP -B 3 -m 1 "call" $CALLFILE | $GREP mov | $GREP -v $KEY_ADDR | $GREP -v movb | $GREP -oE "0x[0-9a-z]+" | $HEAD -n 1)
  314.                 i=$(($i + 1))
  315.                 if [ $i -eq 10 ]; then
  316.                         echo "[-] Error, function call previous first call of arc4() hasn't been identified..."
  317.                         exit_error
  318.                 fi
  319.         done
  320.         echo -e "\t[+] PWD address found : [$KEY_ADDR]"
  321.         echo -e "\t[+] PWD size found : [$KEY_SIZE]"
  322.  
  323.         # Defining the address without 0x.
  324.         KEY=$(echo $KEY_ADDR | $CUT -d 'x' -f 2)
  325.         # Like the other NLINES
  326.         NLINES=$(( ($KEY_SIZE / 16) +2 ))
  327.         # Like the other LASTBYTE
  328.         LASTBYTE="0x${KEY:$((${#KEY}-1))}"
  329.         # Extract PWD from STRINGFILE
  330.         STRING=$( $GREP -A $(($NLINES-1)) -E "^ ${KEY:0:$((${#KEY}-1))}0 " $STRINGFILE | $AWK '{ print $2$3$4$5}' | $TR '\n' 'T' | $SED -e "s:T::g")
  331.         STRING=${STRING:$((2*$LASTBYTE))}
  332.         STRING=${STRING:0:$(($KEY_SIZE * 2))}
  333.         # Encode / rewrite PWD in the \x??\x?? format
  334.         FINALSTRING=""
  335.         for ((i=0;i<$((${#STRING} /2 ));i++)); do
  336.                 FINALSTRING="${FINALSTRING}\x${STRING:$(($i * 2)):2}"
  337.         done
  338.         VAR_PSWD=$FINALSTRING
  339. }
  340.  
  341. # This function append a generic engine for decrypt from shc project. With out own new variables extracted.
  342. # Rather than execute the source code decrypted, it's printed in stdout.
  343. function generic_file(){
  344. cat > ${TMPBINARY}.c << EOF
  345. #define msg1_z $VAR_MSG1_Z
  346. #define date_z $VAR_DATE_Z
  347. #define shll_z $VAR_SHLL_Z
  348. #define inlo_z $VAR_INLO_Z
  349. #define xecc_z $VAR_XECC_Z
  350. #define lsto_z $VAR_LSTO_Z
  351. #define tst1_z $VAR_TST1_Z
  352. #define chk1_z $VAR_CHK1_Z
  353. #define msg2_z $VAR_MSG2_Z
  354. #define rlax_z $VAR_RLAX_Z
  355. #define opts_z $VAR_OPTS_Z
  356. #define text_z $VAR_TEXT_Z
  357. #define tst2_z $VAR_TST2_Z
  358. #define chk2_z $VAR_CHK2_Z
  359. #define pswd_z $KEY_SIZE
  360. static char msg1 [] = "$VAR_MSG1";
  361. static char date [] = "$VAR_DATE";
  362. static char shll [] = "$VAR_SHLL";
  363. static char inlo [] = "$VAR_INLO";
  364. static char xecc [] = "$VAR_XECC";
  365. static char lsto [] = "$VAR_LSTO";
  366. static char tst1 [] = "$VAR_TST1";
  367. static char chk1 [] = "$VAR_CHK1";
  368. static char msg2 [] = "$VAR_MSG2";
  369. static char rlax [] = "$VAR_RLAX";
  370. static char opts [] = "$VAR_OPTS";
  371. static char text [] = "$VAR_TEXT";
  372. static char tst2 [] = "$VAR_TST2";
  373. static char chk2 [] = "$VAR_CHK2";
  374. static char pswd [] = "$VAR_PSWD";
  375. #define      hide_z     4096
  376. /* rtc.c */
  377. #include <sys/stat.h>
  378. #include <sys/types.h>
  379. #include <errno.h>
  380. #include <stdio.h>
  381. #include <stdlib.h>
  382. #include <string.h>
  383. #include <time.h>
  384. #include <unistd.h>
  385. /* 'Alleged RC4' */
  386. static unsigned char stte[256], indx, jndx, kndx;
  387. /*
  388.  * Reset arc4 stte.
  389.  */
  390. void stte_0(void)
  391. {
  392.         indx = jndx = kndx = 0;
  393.         do {
  394.                 stte[indx] = indx;
  395.         } while (++indx);
  396. }
  397. /*
  398.  * Set key. Can be used more than once.
  399.  */
  400. void key(void * str, int len)
  401. {
  402.         unsigned char tmp, * ptr = (unsigned char *)str;
  403.         while (len > 0) {
  404.                 do {
  405.                         tmp = stte[indx];
  406.                         kndx += tmp;
  407.                         kndx += ptr[(int)indx % len];
  408.                         stte[indx] = stte[kndx];
  409.                         stte[kndx] = tmp;
  410.                 } while (++indx);
  411.                 ptr += 256;
  412.                 len -= 256;
  413.         }
  414. }
  415. /*
  416.  * Crypt data.
  417.  */
  418. void arc4(void * str, int len)
  419. {
  420.         unsigned char tmp, * ptr = (unsigned char *)str;
  421.         while (len > 0) {
  422.                 indx++;
  423.                 tmp = stte[indx];
  424.                 jndx += tmp;
  425.                 stte[indx] = stte[jndx];
  426.                 stte[jndx] = tmp;
  427.                 tmp += stte[indx];
  428.                 *ptr ^= stte[tmp];
  429.                 ptr++;
  430.                 len--;
  431.         }
  432. }
  433. /* End of ARC4 */
  434. /*
  435.  * Key with file invariants.
  436.  */
  437. int key_with_file(char * file)
  438. {
  439.         struct stat statf[1];
  440.         struct stat control[1];
  441.         if (stat(file, statf) < 0)
  442.                 return -1;
  443.         /* Turn on stable fields */
  444.         memset(control, 0, sizeof(control));
  445.         control->st_ino = statf->st_ino;
  446.         control->st_dev = statf->st_dev;
  447.         control->st_rdev = statf->st_rdev;
  448.         control->st_uid = statf->st_uid;
  449.         control->st_gid = statf->st_gid;
  450.         control->st_size = statf->st_size;
  451.         control->st_mtime = statf->st_mtime;
  452.         control->st_ctime = statf->st_ctime;
  453.         key(control, sizeof(control));
  454.         return 0;
  455. }
  456. void rmarg(char ** argv, char * arg)
  457. {
  458.         for (; argv && *argv && *argv != arg; argv++);
  459.         for (; argv && *argv; argv++)
  460.                 *argv = argv[1];
  461. }
  462. // Update 18/11/2015 : Update "mask" casting from "unsigned" to "unsigned long".
  463. int chkenv(int argc)
  464. {
  465.         char buff[512];
  466.         unsigned mask, m;
  467.         int l, a, c;
  468.         char * string;
  469.         extern char ** environ;
  470.         mask  = (unsigned long)chkenv;
  471.         mask ^= (unsigned)getpid() * ~mask;
  472.         sprintf(buff, "x%x", mask);
  473.         string = getenv(buff);
  474.         l = strlen(buff);
  475.         if (!string) {
  476.                 /* 1st */
  477.                 sprintf(&buff[l], "=%u %d", mask, argc);
  478.                 putenv(strdup(buff));
  479.                 return 0;
  480.         }
  481.         c = sscanf(string, "%u %d%c", &m, &a, buff);
  482.         if (c == 2 && m == mask) {
  483.                 /* 3rd */
  484.                 rmarg(environ, &string[-l - 1]);
  485.                 return 1 + (argc - a);
  486.         }
  487.         return -1;
  488. }
  489. char * xsh(int argc, char ** argv)
  490. {
  491.         char * scrpt;
  492.         int ret, i, j;
  493.         char ** varg;
  494.         stte_0();
  495.         key(pswd, pswd_z);
  496.         arc4(msg1, msg1_z);
  497.         arc4(date, date_z);
  498.         //if (date[0] && date[0]<time(NULL))
  499.         //        return msg1;
  500.         arc4(shll, shll_z);
  501.         arc4(inlo, inlo_z);
  502.         arc4(xecc, xecc_z);
  503.         arc4(lsto, lsto_z);
  504.         arc4(tst1, tst1_z);
  505.         key(tst1, tst1_z);
  506.         arc4(chk1, chk1_z);
  507.         if ((chk1_z != tst1_z) || memcmp(tst1, chk1, tst1_z))
  508.                 return tst1;
  509.         ret = chkenv(argc);
  510.         arc4(msg2, msg2_z);
  511.         if (ret < 0)
  512.                 return msg2;
  513.         varg = (char **)calloc(argc + 10, sizeof(char *));
  514.         if (!varg)
  515.                 return 0;
  516.         if (ret) {
  517.                 arc4(rlax, rlax_z);
  518.                 if (!rlax[0] && key_with_file(shll))
  519.                         return shll;
  520.                 arc4(opts, opts_z);
  521.                 arc4(text, text_z);
  522.                 printf("%s",text);
  523.                 return 0;
  524.                 /*arc4(tst2, tst2_z);
  525.                 key(tst2, tst2_z);
  526.                 arc4(chk2, chk2_z);
  527.                 if ((chk2_z != tst2_z) || memcmp(tst2, chk2, tst2_z))
  528.                         return tst2;
  529.                 if (text_z < hide_z) {
  530.                         scrpt = malloc(hide_z);
  531.                         if (!scrpt)
  532.                                 return 0;
  533.                         memset(scrpt, (int) ' ', hide_z);
  534.                         memcpy(&scrpt[hide_z - text_z], text, text_z);
  535.                 } else {
  536.                         scrpt = text;
  537.                 }*/
  538.         } else {
  539.                 if (*xecc) {
  540.                         scrpt = malloc(512);
  541.                         if (!scrpt)
  542.                                 return 0;
  543.                         sprintf(scrpt, xecc, argv[0]);
  544.                 } else {
  545.                         scrpt = argv[0];
  546.                 }
  547.         }
  548.         j = 0;
  549.         varg[j++] = argv[0];            /* My own name at execution */
  550.         if (ret && *opts)
  551.                 varg[j++] = opts;       /* Options on 1st line of code */
  552.         if (*inlo)
  553.                 varg[j++] = inlo;       /* Option introducing inline code */
  554.         varg[j++] = scrpt;              /* The script itself */
  555.         if (*lsto)
  556.                 varg[j++] = lsto;       /* Option meaning last option */
  557.         i = (ret > 1) ? ret : 0;        /* Args numbering correction */
  558.         while (i < argc)
  559.                 varg[j++] = argv[i++];  /* Main run-time arguments */
  560.         varg[j] = 0;                    /* NULL terminated array */
  561.         execvp(shll, varg);
  562.         return shll;
  563. }
  564. int main(int argc, char ** argv)
  565. {
  566.         argv[1] = xsh(argc, argv);
  567.         return 1;
  568. }
  569. EOF
  570. }
  572. ##########################################
  573. ## Starting
  574. echo " _   _       _____ _   _      "
  575. echo "| | | |     /  ___| | | |     "
  576. echo "| | | |_ __ \ \`--.| |_| | ___ "
  577. echo "| | | | '_ \ \`--. \  _  |/ __|"
  578. echo "| |_| | | | /\__/ / | | | (__ "
  579. echo " \___/|_| |_\____/\_| |_/\___|"
  580. echo
  581. echo "--- UnSHc - The shc decrypter."
  582. echo "--- Version: $VERSION"
  583. echo "------------------------------"
  584. echo "UnSHc is used to decrypt script encrypted with SHc"
  585. echo "Original idea from Luiz Octavio Duarte (LOD)"
  586. echo "Updated and modernized by Yann CAM"
  587. echo "- SHc   : [http://www.datsi.fi.upm.es/~frosal/]"
  588. echo "- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]"
  589. echo "------------------------------"
  590. echo
  592. if [ $# -lt 1 ]; then
  593.         echo "[?] Type -h or --help for how to use it"
  594.         clean
  595.         exit 0
  596. fi
  598. # Check the availability of each command needed in this script.
  599. check_binaries
  601. OPTS=$( getopt -o h,a:,d:,s:,o: -l help,arc4:,dumpfile:,stringfile:,outputfile: -- "$@" )
  602. if [ $? != 0 ]; then
  603.         exit_error;
  604. fi
  606. while [ "$#" -gt 0 ] ; do
  607.         case "$1" in
  608.                 -h|--help)
  609.                         usage;
  610.                         clean;
  611.                         exit 0;;
  612.                 -a|--arc4)
  613.                         echo "[+] ARC4() offset function call address specified [0x$2]";
  614.                         CALLADDR=$2;
  615.                         shift 2;;
  616.                 -d|--dumpfile)
  617.                         echo "[+] Object dump file specified [$2]";
  618.                         DUMPFILE=$2;
  619.                         shift 2;;
  620.                 -s|--stringfile)
  621.                         echo "[+] String dump file specified [$2]";
  622.                         STRINGFILE=$2;
  623.                         shift 2;;
  624.                 -o|--outputfile)
  625.                         echo "[+] Output file name specified [$2]";
  626.                         OUTPUTFILE=$2;
  627.                         shift 2;;
  628.                 -*)
  629.                         echo "[-] Unknown option: [$1]" >&2;
  630.                         exit_error;;
  631.                 --)
  632.                         shift;
  633.                         break;;
  634.                 *)
  635.                         echo "[*] Input file name to decrypt [$1]";
  636.                         BINARY=$1
  637.                         shift 1;;
  638.         esac
  639. done
  641. if [ ! -e $BINARY ]; then
  642.         echo "[-] Error, File [$BINARY] not found."
  643.         exit_error
  644. fi
  645. if [ -z "$DUMPFILE" ]; then
  646.          DUMPFILE=$(mktemp /tmp/XXXXXX)
  647. else
  648.         if [ ! -e $DUMPFILE ]; then
  649.                 echo "[-] Object dump file [$DUMPFILE] not found."
  650.                 exit_error;
  651.         fi
  652. fi
  653. if [ -z "$STRINGFILE" ]; then
  654.          STRINGFILE=$(mktemp /tmp/XXXXXX)
  655. else
  656.         if [ ! -e $STRINGFILE ]; then
  657.                 echo "[-] String dump file [$STRINGFILE] not found."
  658.                 exit_error;
  659.         fi
  660. fi
  662. # Fill DUMPFILE and STRINGFILE from objdump of the *.sh.x encrypted script
  663. generate_dump
  665. # Find out the most called function. This function is arc4() and there are 14 calls.
  666. # Then retrieve the data used in each CALLADDR call
  667. c=1
  668. if [ -z "$CALLADDR" ]; then
  669. 	# Case when ARC4 offset is unknown and there are multiple candidate
  670.         while [[ $($WC -l < $CALLSIZEFILE) -ne 14 ]]; do
  671. 		extract_arc4_call_addr "$c"
  672.                 extract_variables_from_binary
  673. 		c=$(($c + 1))
  674.         done
  675. else
  676. 	# Case when the ARC4 address is already defined and passed throught args
  677. 	extract_variables_from_binary
  678. fi
  680. # Retrieve PWD from function call just before the first CALLADDR call
  681. extract_password_from_binary
  683. # Create a C source code to decrypt *.sh.x file with previously extracted data
  684. generic_file
  686. # Compile C source code to decrypt *.sh.x file
  687. $GCC -o $TMPBINARY ${TMPBINARY}.c >/dev/null 2>&1
  689. echo "[*] Executing [$TMPBINARY] to decrypt [${BINARY}]"
  691. chmod +x $TMPBINARY
  692. if [ -z "$OUTPUTFILE" ]; then
  693.         echo "[*] Retrieving initial source code in [${BINARY%.sh.x}.sh]"
  694.         $TMPBINARY > ${BINARY%.sh.x}.sh
  695. else
  696.         echo "[*] Retrieving initial source code in [$OUTPUTFILE]"
  697.         $TMPBINARY > $OUTPUTFILE
  698. fi
  700. echo "[*] All done!"
  701. clean
  702. exit 0

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Gausst松鼠会/article/detail/361498
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号