Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/yanncam/unshc
UnSHc - How to decrypt SHc *.sh.x encrypted file ?
https://github.com/yanncam/unshc
arc4 arm bash decryption encryption mips shc shell shellscript unshc x64 x86
Last synced: 3 days ago
JSON representation
UnSHc - How to decrypt SHc *.sh.x encrypted file ?
- Host: GitHub
- URL: https://github.com/yanncam/unshc
- Owner: yanncam
- License: gpl-3.0
- Created: 2016-03-02T20:27:32.000Z (almost 9 years ago)
- Default Branch: master
- Last Pushed: 2020-10-15T08:28:30.000Z (over 4 years ago)
- Last Synced: 2025-01-19T12:06:13.667Z (3 days ago)
- Topics: arc4, arm, bash, decryption, encryption, mips, shc, shell, shellscript, unshc, x64, x86
- Language: Shell
- Homepage:
- Size: 91.8 KB
- Stars: 368
- Watchers: 24
- Forks: 254
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# UnSHc
UnSHc - How to decrypt SHc *.sh.x encrypted file ?
# Please note
I will not decrypt any file for people.
Issues on GitHub are only to discuss about bug and/or improvement of the tool "UnSHc".
**Due to the many problems since shc 4.0.3, there seems to be a need for clarification. In shc 4.0.3 many structural changes have been incorporated, so that shc now makes use of various security mechanisms provided by the linux-kernel itself. Therefore, it is now almost impossible to extract the original shell script at all with current UnSHc version, if the new shc version was used. This requires a more in-depth approach, which means that a modified bash or a modified linux-kernel is needed to bypass the security measures.**
If you think you have found a bug, please provide me the encrypted file ***AND the unencrypted file corresponding***. Without these two files I can't reverse it and analyze it.
Add some information about the architecture where the encrypted file has been created (what linux distribution and version, what architecture x86 or x64, etc.).
***All others "file decryption issues" will be closed directly.***
# SHc review
SHc (SHell compiler) is a fabulous tool created and maintained by Francisco Javier Rosales Garcia (http://www.datsi.fi.upm.es/~frosal/).
This tool protect any shell script with encryption (ARC4).
```shell
wget -q http://www.datsi.fi.upm.es/~frosal/sources/shc-3.8.9.tgz
tar zxvf shc-3.8.9.tgz
cd shc-3.8.9
make
```
# How to use SHc ?
```shell
root@server:~/shc/shc-3.8.9# shc -h
shc Version 3.8.9, Generic Script Compiler
shc Copyright (c) 1994-2012 Francisco Rosales
shc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script
-e %s Expiration date in dd/mm/yyyy format [none]
-m %s Message to display upon expiration ["Please contact your provider"]
-f %s File name of the script to compile
-i %s Inline option for the shell interpreter i.e: -e
-x %s eXec command, as a printf format i.e: exec('%s',@ARGV);
-l %s Last shell option i.e: --
-r Relax security. Make a redistributable binary
-v Verbose compilation
-D Switch ON debug exec calls [OFF]
-T Allow binary to be traceable [no]
-C Display license and exit
-A Display abstract and exit
-h Display help and exit
Environment variables used:
Name Default Usage
CC cc C compiler command
CFLAGS C compiler flags
Please consult the shc(1) man page.
```
Encrypted shell script are named "*.sh.x" by default.
UnSHc is a tool to reverse the encryption of any SHc encrypted *.sh.x script.
# How to use UnSHc ?
```shell
[root@server:~/unshc]$ ./unshc.sh -h
_ _ _____ _ _
| | | | / ___| | | |
| | | |_ __ \ `--.| |_| | ___
| | | | '_ \ `--. \ _ |/ __|
| |_| | | | /\__/ / | | | (__
\___/|_| |_\____/\_| |_/\___|
--- UnSHc - The shc decrypter.
--- Version: 0.6
------------------------------
UnSHc is used to decrypt script encrypted with SHc
Original idea from Luiz Octavio Duarte (LOD)
Updated and modernized by Yann CAM
- SHc : [http://www.datsi.fi.upm.es/~frosal/]
- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]
------------------------------
[*] Usage : ./unshc.sh [OPTIONS]
-h | --help : print this help message
-a OFFSET | --arc4 OFFSET : specify the arc4() offset arbitrarily (without 0x prefix)
-d DUMPFILE | --dumpfile DUMPFILE : provide an object dump file (objdump -D script.sh.x > DUMPFILE)
-s STRFILE | --stringfile STRFILE : provide a string dump file (objdump -s script.sh.x > STRFILE)
-o OUTFILE | --outputfile OUTFILE : indicate the output file name
[*] e.g :
./unshc.sh script.sh.x
./unshc.sh script.sh.x -o script_decrypted.sh
./unshc.sh script.sh.x -a 400f9b
./unshc.sh script.sh.x -d /tmp/dumpfile -s /tmp/strfile
./unshc.sh script.sh.x -a 400f9b -d /tmp/dumpfile -s /tmp/strfile -o script_decrypted.sh
```
UnSHc can only decrypt SHc encrypted file on **X86/x64** architecture.
* Demonstration in video :
* https://www.youtube.com/watch?v=tmHVhMuG-Vg
* SHc (in french) :
* https://www.asafety.fr/prog-and-dev/bashshunix-shc-le-compilateur-et-protecteur-de-script-shell/
* UnSHc (in french) :
* https://www.asafety.fr/unshc-the-shc-decrypter/
# UnSHc-MIPS
Thanks to @fffonion, a dedicated version of UnSHc has been released targeting SHc encrypted file on MIPS architecture.
This **UnSHc-MIPS** version is available here : https://github.com/fffonion/UnSHc-MIPS
Thank you again for your work and contribution !
# UnSHc-ARM
Thanks to @cliffalbert, a dedicated version of UnSHc has been released targeting SHc encrypted file on ARM architecture.
This **UnSHc-ARM** version is available here : https://github.com/cliffalbert/UnSHc-arm
Thank you again for your work and contribution !