9

How can I encrypt or scramble my shell script so that it's unreadable to the naked eye? Either method would be acceptable, please provide specific steps.

  • In my opinion shc has some shortcomings: I've an ongoing project on github (obash) where I try to address these issues. You might like to see if it suits you better then shc. – louigi600 Feb 8 '17 at 9:40
11

SHC

You can try the steps outlined on this website, titled: How to Encrypt Your Bash Shell Script on Linux Using SHC. This article discusses the use of a tool called SHC - Shell script Compiler.

URL resources

This is an executable that you'll have to build using gcc/g++.

Usage

$ ./shc -f random.sh

Once you run it your shell script, random.sh will get converted into this file:

-rwx-wx--x. 1 ramesh ramesh 11752 Mar 27 01:12 random.sh.x

Is this foolproof?

No there is a good analysis of the method used by the SHC tool which shows that it's not overly strong and can be circumvented if you know what you're doing. The article was post on the linuxjournal.com website, titled: Paranoid Penguin - Limitations of shc, a Shell Encryption Utility.

NOTE: These classes of tools are probably better described as obfuscators.

  • @sim Thanks . Is there any way to decrypt that script ??? – Ram Sep 11 '13 at 5:10
  • @Ram - yes this is by no means foolproof. What are you trying to hide? User/password info or just how the script works? – slm Sep 11 '13 at 5:12
  • @sim i am trying to hide how the script works? – Ram Sep 11 '13 at 5:17
  • @Ram - OK it's probably OK for that, I wouldn't recommend it for trying to hide passwords. When I tried this app it was behaving a bit odd on my computer. I'd try it, but the resulting executables were launching as if they were backgrounded, and I had to do the command fg to bring it to the forground and then it worked fine. I'm still looking for alternatives. – slm Sep 11 '13 at 5:20
  • 9
    Despite the name, SHC doesn't encrypt the script in any meaningful way. Encrypting implies that it gets decrypted before use. If the script can be executed, it has to be decrypted first and can be extracted at that point. Transforming a program to make it harder to understand while not changing its behavior is called obfuscation. It's very very very rarely worthwhile, and for a shell script, that's a gross overestimation of its usefulness. – Gilles 'SO- stop being evil' Sep 11 '13 at 22:34
29

If you want to encrypt a shell script, use GPG. Whoever wants to run your script will of course have to decrypt it first.

If you want someone to be able to run the script but not read it, that's a completely different problem which has nothing to do with encryption. It's called obfuscation.

If you have a password or other confidential information in that script, no amount of obfuscation is going to hide it. Sooner or later the script will use the password to do something and at that point the password will appear clearly to anyone looking for it.

If you want to hide how your script works because you're afraid someone will copy it, forget about it. Nobody cares.

If you want to hide your script because you're ashamed of its quality, fix it.

If you want to hide how your script works because you want to hide what it does, it's not doable. Someone can look at your script while it's executed and watch what it's doing.

If you've read that far and still want to “encrypt” your script, you're misunderstanding something major. Don't send your script to anyone, or send it in plain text.

  • 4
    +1 for 'nobody cares'. except that some do care - i'd take one look at an obfuscated shell script and think "no way in hell am i going to run that on my system". – cas Sep 14 '13 at 2:38
  • 1
    Sorry, people do care and it is important. You have a perspective and an alternate perspective exists. Both will have it takers. Meanwhile the answer below works well for me to begin with. Most of the time we want to protect from casual hackers / users. Understand well that determined hackers will break thru anything. – anil Nov 22 '18 at 9:51
  • @anil You're only protecting against people who wouldn't be smart or competent enough to do anything with the source code. It might make you feel better, but it doesn't make you more secure. – Gilles 'SO- stop being evil' Nov 22 '18 at 10:29
  • @gilles maybe i read you wrong. I am actually trying to protect against people who are competent to do something with the source code if they had it (source code = content of the script). Only these people may not know how to hack an encrypted file without going into lot of trouble to figure out how. Against the really determined _ I agree there are no really good defenses. – anil Nov 22 '18 at 11:06
11

Got this while searching internet,courtesy Claudio P.

  1. Write your script (script-base.sh)

    #!/bin/sh 
    echo "Hello World" 
    
  2. Encrypt your script (give a password):

    openssl enc -e -aes-256-cbc -a -in script-base.sh > script-enc 
    
  3. Write de Wrapper (script-final.sh):

    #!/bin/sh 
    openssl enc -d -aes-256-cbc -a -in script-enc | sh - 
    
  4. Run "script-final.sh", enter the password, and the script will run without write the plain text script on disk.

1

Basically you can obfuscate but not compile your script. The simple reason is that shell scripts are interpreted individual commands which needs to be executed one by one by the system, and that you can see those commands as they are executed one by one by the system with the sh -x flag (and perhaps also the -v flag)

For most programmers that will be sufficient to understand what is going on.

You can obfuscate your variables and general flow if you want it, but you cannot obfuscate the indvidual commands executed by your program - which for shell scripts usually are all of them.

The simplest solution is probably rewriting the shell script in a compiled language like C.

  • 1
    Even a compiled binary can be disassembled and reverse-engineered if one is determined enough. – Joseph R. Sep 11 '13 at 22:40
  • 3
    Everything executable can be reverse-engineered. The requirement here was it should be unreadable to the naked eye – Thorbjørn Ravn Andersen Sep 11 '13 at 22:55
  • I know. I'm just leaving a note for future readers. – Joseph R. Sep 11 '13 at 22:56
-2

try submitting your script to this site if you wish to hide it from public view.

while many may disagree with the idea of encrypting or obfuscating the source code of a script written in an interpreted language, i understand why folks want to do this.

as someone who has had his work stolen many times, i simply do not care if "obfuscation" or "encryption" is a taboo. as long as my script is protected and it works as it did before encryption, Im quite content. never again will i allow someone else to take my ideas and run with it. and no, writing my script in a compiled language is not any option. i do not know how to.

anyway, if you do not want to use the site mentioned above, try the latest version of shc. I believe they've updated it in github to address the many security concerns others have mentioned. type the following into google "shc github" and you'll see a host of available options you can try out.

good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.