Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Can a encryption password <password> in compiled script script.x be easily recovered?
The source version of script.x would be for instance
# cat script
openssl enc -des3 -in myfile -out myfile.des -k <password>
and the compiled version script.x is obtained with
# shc -f script
Can I recover <password> if I only have script.x without long lasting bruteforcing?
Personally, I do not know - my opinion is that it is easy.
I would not try to reverse engineer script by using brute force to 'decrypt' the compiled script - instead would try to discover by using an audit of commands that are executed by "sh", "bash" and just examine the command arguments.
Worst case: /usr/bin/ps would/could show the password and/or /proc/*/"something" - do not know /proc well enough to specify the file containing the command arguments
cat /proc/1234/cmdline where 1234 is the PID of openssl.
Nov 25, 2016 at 1:14
Yes, it's pretty easy, even if you don't know anything about the compiled format. You just run the script in a debugger and catch when it uses the password for something. As a general principle, it's impossible to hide a password that's being used on someone else's machine. If they can run software that uses the password then they can see the password.
In this case, even that is overkill: since the password is passed to the openssl command, all you need is to put a wrapper for openssl that logs its arguments, or to observe the openssl process while it's running.
In addition, it's likely that the password can be recovered from the encrypted file, by simple brute force, which will not be as long as it should be. openssl enc is horribly bad at generating an encryption key from a password: this should be slow (see Possible to show Metasploitable (Linux) password in plain text?, How to securely hash passwords?) but openssl enc makes it fast, and worse, you're not even using it correctly: you're using it without a salt. See How to gradually encrypt the tshark output file along the capture? for what to do instead.
A word of warning: from your recent questions, you appear to be well over your head when it comes to security. I strongly recommend that you stick to simple things and keep your system's defaults as much as possible. Your attempts to use tools that you don't understand to make unnecessary improvements tend to make things worse.
