protecting my script [help] !!

[hendnov]

Hi guys,

do you know how to protect my shell script? by putting password or encript it or whatsoever, so any other people can't change my script.

THX GUYS,

 

[mrn]

Try SHC - shell script compiler

http://www.datsi.fi.upm.es/~frosal/

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[feherke]

Hi

Upon execution, the compiled binary will decrypt and execute the code with the shell -c option.

-c string If the -c option is present, then commands are read from string.

So theoretically :
[ul]
[li]become root or copy the [tt]shc[/tt] protected script to a machine where you have root privileges[/li]
[li]create a small program which output its parameters to stdout or a file[/li]
[li]replace [tt]/bin/bash[/tt] and/or other shells with your small program[/li]
[li]run the [tt]shc[/tt] protected script[/li]
[li]do not forget to put back your original shells[/li]
[/ul]
Is [tt]shc[/tt] able to filter out such tricks ? I have no Un*x handy, could anyone try this out ? Thanks.

Feherke.

http://rootshell.be/~feherke/

 

[lpblauen]

How do you make shc work in aix5.2 with gcc compiler? The code doesn't list aix and seems to only like a cc complier which I don't have?? I too would like to compile some of my scripts.

 

[mrn]

Why do you need to do this? Are you the only server admin?

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[mrn]

Feherke.

There are indeed some issues with robustness of shc

see

http://www.linuxjournal.com/article/8256

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[mrn]

Also found

Bourne shell compiler

http://www.comeaucomputing.com/faqs/ccshfaq.html

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[feherke]

Hi

Thanks for that URL, Mike. Interesting article.

Feherke.

http://rootshell.be/~feherke/

 

[SamBones]

If you just need to protect the script from changes, why not just change the permissions?

chmod 700 script.sh    # Only you can run, view, or change it
chmod 755 script.sh    # Anyone can run, only you can change

 

[rzs0502]

Or maybe use Python or Perl?

"If you always do what you've always done, you will always be where you've always been."

 

[hendnov]

Hi guys,

Thanks for the input, I'm not the admin, but I'm the technical UNIX analyst, and I still got a problem here.
I've downloaded shc and here's the files of shc:

CHANGES*     Makefile*    shc.1*       shc.README*  
Copying*     match*       shc.c*       core         pru.sh*      shc.html*

when I tried to compile :

shc -v -r -f testdisc

./CHANGES: 3.7: command not found
./CHANGES: philipp@open.ch: No such file or directory
./CHANGES: -: command not found
./CHANGES: -: command not found
./CHANGES: -: command not found
./CHANGES: -: command not found
./CHANGES: bryan.hogan@dstintl.com: No such file or directory
./CHANGES: -: command not found
./CHANGES: 3.6: command not found
./CHANGES: Two: command not found
./CHANGES: -D: command not found
./CHANGES: -T: command not found
./CHANGES: Bash: command not found
./CHANGES: 3.5: command not found
./CHANGES: Rewrite: command not found
./CHANGES: warnings: command not found
./CHANGES: 3.4: command not found
./CHANGES: Remove: command not found
./CHANGES: pid: No such file or directory
./CHANGES: 3.3: command not found
./CHANGES: Prevent: command not found
./CHANGES: 3.2: command not found
./CHANGES: Find: command not found
./CHANGES: 3.1: command not found
./CHANGES: Fixed: command not found
./CHANGES: line 81: syntax error near unexpected token `(i'
./CHANGES: line 81: `   equal to "end of options" (i.e.  #!/bin/sh -- )'
./CHANGES: 3.8.3: command not found
./CHANGES: jacek@dyski.one.pl: No such file or directory
./CHANGES: -: command not found

I've got that kind of error, can anyone help me why ?

THX

 

[Annihilannic]

Did you run make to build shc?

If you get those errors it sound like you already have something called shc on your system. What do you get if you type which shc or whence -v shc?

Annihilannic.

 

[mrn]

Also not a good idea to post data that contains email addresses.

I'd read flag it if I were you and ask the the addresses to be removed.....

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[hendnov]

what command to build shc using "make"?

my script is only one which is testdisc

Could you please tell me what command should I type from beginning ? as there's no shc file in the package that I downloaded, just only shc.c, shc.1 and shc.html.

THX guys

 

[feherke]

Hi

[ul]
[li]enter the directory where you extracted those files[/li]
[li]type [tt]make[/tt] to the command prompt[/li]
[/ul]
After done successfully, in that directory you sould have a file called [tt]shc[/tt] with execute permission.

Feherke.

http://rootshell.be/~feherke/

 

[PHV]

Why not read shc.README ?

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[Annihilannic]

henguard,

You have downloaded the source code for shc. You need to compile it first to make an executable binary (called shc). Then you can use that in turn to compile testdisc. As PHV said, read the README.

Annihilannic.

 

[lpblauen]

Its real easy to compile the code. There are 3 ways.
1. run the make command
2. cc shc.c -o shc
3. gcc shc.c -o shc

Once you have the shc made just run it against your program like this.
shc -v -r -f testdisc

One problem if you are using gcc as the compiler you will get errors once shc makes the output file testdisc. All you would then do is run the following command to make it using gcc.

gcc testdisc.x.c -o testdisc.ksh

Then you can run testdisc.ksh or what ever you name it.

 

[hendnov]

Hi guys,

Thanks for the input, but I still got error..

here's my tried

adoc syducmp02 ~/shc/shc-3.8.3> ls
CHANGES        match*         shc.c          test.bash*
Copying        pru.sh*        shc.html       test.csh*
Makefile       shc.1          shc.README     testdisc.ksh*

adoc syducmp02 ~/shc/shc-3.8.3> make
cc -Wall -O6 -pedantic shc.c -o shc
make: cc: Command not found
make: *** [shc] Error 127

adoc syducmp02 ~/shc/shc-3.8.3> make test
cc -Wall -O6 -pedantic shc.c -o shc
make: cc: Command not found
make: *** [shc] Error 127

I've actually read the readme file and it didnt help
here's the readme file :

Purpose:

        A generic shell script compiler. Shc takes a script, which is
        specified on the command line and produces C source code. The
        generated source code is then compiled and linked to produce a
        stripped binary executable. Use with care.

Building:

        Just do a "make"


Testing:

   Try:  "make test"
    or:  "shc -v -f match"  then  "match.x sh"

        Caveat emptor: see Copyright

        The results look fine to me, but I havn't used this in anger, but
        the author has used shc for his work widely over SunOS, Solaris and
        Linux, and done some testing on Irix and HPUX.

        We tested it on a few SMALL ksh scripts - big tasks should probably
        be written in C in the first place (see _SC_ARG_MAX below)!


Bugs:

        The one (and I hope the only) limitation using shc is the
        _SC_ARG_MAX system configuration parameter.

        It limits the maximum length of the arguments to the exec function,
        limiting the maximum length of the runnable script of shc.

        !! - CHECK YOUR RESULTS CAREFULLY BEFORE USING - !!


Archived at: ftp://hpux.csc.liv.ac.uk/hpux/Languages/shc-2.4a
Archived by: steff@csc.liv.ac.uk

Author:  Francisco Rosales Garcia

Or, I guess I should change the Makefile. If I should, could you guys tell which part ?

Here's the Makefile's code

# Makefile
#

INSTALL_PATH = /usr/local

# For SCO
CFLAGS = -b elf -O -D_SVID

# For IRIX
CFLAGS = -xansi -fullwarn -O3 -g0

# For Solaris
CFLAGS = -fast -xO4 -s -v -Xa

# For HPUX
CFLAGS = -Wall -O -Ae

# For OSF1
CFLAGS = -w -verbose -fast -std1 -g0

# For GNU C compiler
CFLAGS = -Wall -O6 -pedantic

SHELL = /bin/sh

all: shc ask_for_test

shc: shc.c
        $(CC) $(CFLAGS) $@.c -o $@

ask_for_test:
        @echo '***      Do you want to probe shc with a test script?'
        @echo '***      Please try...   make test'

test: make_the_test ask_for_strings

make_the_test: match.x
        @echo '***      Running a compiled test script!'
        @echo '***      It must show files with substring "sh" in your PATH...'
        ./match.x sh

match.x: shc match
        @echo '***      Compiling script "match"'
        CFLAGS="$(CFLAGS)" ./shc -v -f match

ask_for_strings:
        @echo '***      Do you want to see strings in the generated binary?'
        @echo '***      Please try...   make strings'

strings: make_the_strings ask_for_install

make_the_strings: match.x
        @echo '***      Running: "strings -n 5 'match.x'"'
        @echo '***      It must show no sensible information...'
        strings -n 5 match.x

ask_for_install:
        @echo '***      Do you want to install shc?'
        @echo '***      Please try...   make install'

install: shc
        @echo '***      Installing shc and shc.1 on '$(INSTALL_PATH)
        @echo -n '***   Do you want to continue? '; read ANS; case "$$ANS" in y|Y|yes|Yes|YES) ;; *) exit 1;; esac;
        install -c -s shc $(INSTALL_PATH)/bin/
        install -c -m 644 shc.1 $(INSTALL_PATH)/man/man1/

clean:
        rm -f *.o *~ *.x.c

cleanall: clean
        rm -f shc *.x

Thanks guys for any help you provide

 

[rzs0502]

Do you have a C Compiler on the machine?
If you do and the compiler is invoked by running gcc or xlc etc.
eg. export CC=/usr/bin/gcc



"If you always do what you've always done, you will always be where you've always been."