Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/rem01gaming/unshell
Effortlessly deobfuscate any shell scripts
https://github.com/rem01gaming/unshell
base64 bash-obfuscate deobfuscation obfuscation shc shell shell-script shell-scripting ssc
Last synced: about 2 months ago
JSON representation
Effortlessly deobfuscate any shell scripts
- Host: GitHub
- URL: https://github.com/rem01gaming/unshell
- Owner: Rem01Gaming
- License: gpl-3.0
- Created: 2024-09-13T11:55:33.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2024-10-06T03:23:31.000Z (3 months ago)
- Last Synced: 2024-11-08T10:04:02.927Z (about 2 months ago)
- Topics: base64, bash-obfuscate, deobfuscation, obfuscation, shc, shell, shell-script, shell-scripting, ssc
- Language: Shell
- Homepage:
- Size: 449 KB
- Stars: 6
- Watchers: 1
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
README
# Unshell
> The Script Kiddies Nighmare
Effortlessly deobfuscate shell scripts back into source code even with heavenly and multi layered obfuscation. unshell will search for patterns on shell script, determine and deobfuscate accordingly.
## Features
- Zero configuration: There's no need for any configuration
- Penetrate: Multi layered obfuscation is not a problem
- Easy to use: just `unshell -f encrypted1 encrypted2` in cmd
## Supported obfuscation method
Shell Script Compiler (SHC)
SHC works internally called execve to shell, it decrypted at runtimes and visible via command line args process
eg: /bin/sh -c "decrypted shell"
Simple Script Compiler (SSC)
It works almost the same as SHC but this one uses C++ and shell reads from file descriptor `3`. It visible via `fd` number 3 on the process.
Ri-crypt
Ri-crypt works internally called execve to shell, it decrypted at runtimes and visible via command line args process. we can retrive the shell script using `strace`.
bash-obfuscate (Node.js CLI)
bash-obfuscate works by randomize the script with random variables then execute it in `eval` command.
Bashrock
Bashrock works almost the same way as bash-obfuscate.
TPP Tool
The creator of the this obfuscation said "it has anti-decode feature" despite of multilayered base64 encoding that he use can easily decoded.
As time of this being written, unshell support up to version 12 of this "tool".
BashProtector
Bashrock randomize the script with random variables layered by single `base64` encryption, then execute it in single `eval` command.
Extreme comment/editor EOF trick
Some people obfuscate their script with adding generous amounts of comments in the script until it becomes a really big file, tricking average text editor to shit itself while opening the script so people can't open it.
bzip2
Usually used for obfuscating tunneling/VPN scripts. the actual script is compressed with bzip2 and snuck'ed inside the decompression script itself.
Axeron online module
The script is actually stored somewhere online (usually public GitHub pages, script kiddies ahh behavior) and script on the module does only execution of the actual script after downloaded from cloud, the file link itself is obfuscated with base64 and rot17.
base64
Not too crazy, just classic echo "ZWNobyBzb21lIGJhc2U2NCBlbmNyeXB0ZWQgc2hpdAo=" | base64 -d | sh.
## Installation
```shell
spath=$(echo $PATH | cut -d: -f1)
curl -sLo $spath/unshell https://github.com/Rem01Gaming/unshell/raw/main/unshell
chmod +x $spath/unshell
```
## Usage
```yaml
unshell - Deobfuscate any shell scripts with multiple methods
Usage: unshell [OPTIONS] [FILE]
Usage: unshell [OPTIONS] [DIR]
Options:
-h, --help
print this message
-f, --file [FILE]
Scripts you wanted to deobfuscate, multi input is supported
-r, --recursive [DIR]
Recursively find and deobfuscate all files in the specified directory
-v, --verbose
Be verbose
-d, --execve-delay [SECOND]
Set custom execve delay time in seconds for SHC and SSC encryption
-U, --update
Update the script
Example usages:
unshell -f install.sh menu.sh
unshell -v -f /system/bin/gaming_script
unshell -d 6.018 -f ./VTK
unshell -r .
```
## WARNING
Using unshell to retrieve the original shell script from SHC, SSC, or Ri-crypt obfuscation could potentially harm your machine, these obfuscation type requires to executing the script to order to deobfuscate thus leave your machine in danger if script does something malicious. Avoid running unshell with root permissions unless you fully trust the script!
## Special Credits
- [kawaii-ghost](https://github.com/kawaii-ghost/deshc) for decsh (shc and ssc deobfucator).
- [RiProG-id](https://github.com/RiProG-id/Universal-Shell-Dec.git) for universal-shell-dec, the inspiration and foundation of this project.