Script Security

Applications Cybersecurity
1

Hi there,

I 've created some scrips which I want to wrap them so that the client won't be able to see any of the code.

I 've tried to use "shc" compiler but unfortunately when the script is running and I do "ps -ef" I can see all the code there.

Is there a way that I can overcome this?

Thanks

2

Are you looking for shell script obfuscator ?

3

I am looking for a tool which will help me to conceal the contents of my script

4

Thanks for your reply.

I am looking for a tool which will help me conceal my scripts. I am working on an IBM AIX Server

5

You shouldn't be seeing the script with ps but you will see command line arguments and environment variables as they are used.

Alas, for "sh" to execute your script it needs to be able to read it.

However you could set up your own shell where all the scripts are owned by some obscure user, and the shell is a set-uid process that flips to that user. But then that user would not have the same rights as the current user.

But you would still need little wrappers...

#!/bin/sh
exec /my/magic/shell /some/hidden/shell/script.sh $@
6

The thing is that shc works perfect for making scripts invisible but when you do ps you see all the code there. Maybe the best solution is to put some C code inside and then wrap it. Any other ideas ?

7

I tried the obfsh utility and it seems that I am doing sth wrong

I typed

obfsh -f file_to_obfuscate

and I get

obfsh[607]: syntax error at line 617 : `(' unexpected

Any ideas why this happened ?

Thanks

8

Yeah, id use some C code even make it in full C if i have time and will ... plus with the binary generated you can add further 'protection' to prevent debugging (at least make it a lot harder)...