Obash


Obash is a bash script obfuscator written in C programming language. The bash obfuscator encodes and encrypts bash shell scripts into executable binaries much like Shc the shell script compiler, the project that inspired it, but uses AES-256 encryption and the key and initialization vector are retrieved from the hardware instead of being hard coded into the binary itself. The obash project was started to address some of the issues that afflict shc, the main one being able to see the original shell script source by simply issuing "ps -ef". Although the objectives are the same obash shares no code with shc and was built from scratch from the ground up, any code similarities are purely accidental and dictated by the shared objectives.
Obash is still work in progress but the master branch on github generally has usable sources while the testing branch may be in a transition state at any given time.

How it works internally

Obash takes the input script and aes-256 encodes it, and also base64 encodes the AES cipertex so that it can be used to declare an unsigned char array.
It then produces an intermediate c file which is basically the interpreter, functions, text array containing the cipher text, the optional raw key and iv for reusable binaries and the main. The intermediate c file is then compiled into an executable.
The intermediate c file is built in the following manner :
includes block from interpreter.h
crypted_script variable containing the base64 aes-256 encoded script
serial and uuid variables
functions block from interpreter.h
main_body block from interpreter.h
See recreate_interpreter_header script for details on how interpreter.h is created from interpreter.c.

Key and initialization vector for AES-256 encoding

The key and iv are not hard-coded into the binary but are retrieved each time from the hardware. In case of a reusable static binary then the uuid and serial are in the binary itself but will be manipulated anyway by makekey and makeiv so that they are not usable immediately should anyone ever inspect the binary itself.
Although the whereabouts from where the serial and uuid are retrieved is traceable and is not a secret these should be then manipulated in a way that they are not directly usable as is. In the code there is a comment suggesting where this should be done : each and every one of you using obash is encouraged to do so or it would be fairly easy to extract the script source from the obfuscated binary.. In the distributed code, as an example, the "-" are stripped from the uuid and the serial is padded to reach the suggested length for the cipher used.

Alternatives

  3. Shc the shell script compiler