willshiao / node-bash-obfuscate

A Node.js CLI tool and library to heavily obfuscate bash scripts.

node-bash-obfuscate

A Node.js CLI tool and library to heavily obfuscate bash scripts.

Installation

$ npm install -g bash-obfuscate
$ bash-obfuscate script.sh -o output.sh

Usage

Usage: bash-obfuscate <inputFilename> [options]

Options:
  -o, --out                       Output file
  -c, --chunk-size, --chunk-size  Chunk size (for variables in obfuscated code)
                                                                    [default: 4]
  -r, --randomize                 Randomize variable order
                                                       [boolean] [default: true]

Example

Input

#!/usr/bin/env bash

USR_VAR='I like Node.js!'

echo $USR_VAR
for (( i = 0; i < 10; i++ )); do
    echo $i
done
echo "It works!"

Output

z="
";Hz='echo';Gz=''\''';Lz='for ';Qz='; i+';Ez='Node';Cz=''\''I l';Uz='done';Jz='R_VA';Az='USR_';Fz='.js!';Nz=' = 0';Bz='VAR=';Kz='R';Rz='+ ))';Wz=' wor';Iz=' $US';Vz=' "It';Oz='; i ';Sz='; do';Mz='(( i';Tz=' $i';Xz='ks!"';Pz='< 10';Dz='ike ';
eval "$Az$Bz$Cz$Dz$Ez$Fz$Gz$z$Hz$Iz$Jz$Kz$z$Lz$Mz$Nz$Oz$Pz$Qz$Rz$Sz$z$Hz$Tz$z$Uz$z$Hz$Vz$Wz$Xz"

FAQ

How does it work?

This tool divides the bash script into chunks (size specified by the -c flag). It then assigns a variable name to each chunk (with the same variable name for identical chunks) and replaces the original script with variable references, essentially scrambling the original script.

How do I deobfuscate a script?

Although this does not provide a method of automatically deobfuscating a script, it can be fairly easily done manually. To deobfuscate a bash script, you just have to have the script print out the contents of the deobfuscated script instead of having the script execute it.

No detailed instructions will be provided because the exact details will vary as new obfuscation stages are added to the script.

What's the point? I can deobfuscate it so easily...

The idea is not to provide absolute or even robust protection for your code against someone with a good understanding of bash. Its main purpose is to discourage tampering from someone with little/no understanding of bash.

The main problem with bash obfuscation is that the code can always be printed out when it is about to be executed, which is also when the code is deobfuscated.

node-bash-obfuscate's Issues

Update NPM dependencies

How to desobfuscate

Hello, how to desobfuscate something obfuscated with this?

when used debugging mode "sh -x obfuscated script" then the original script is seen

In case more than one single quote present in chunk, only will be replaced.

node-bash-obfuscate/lib/obfuscate.js

Line 51 in eb931fd

chunk = chunk.replace("'", "'\\\''");

In case more than one single quote present in chunk, only will be replaced. But we need replace all of these single quote actually.
It's better change line 51 as below:
chunk = chunk.replace(/'/g, "'\''");

Don't work at all

birkhoff at Birkhoff-MBPR in ~/dev/tesasd
$ bash-obfuscate
env: node\r: No such file or directory

$ bash-obfuscate 123.sh -o 321.sh
env: node\r: No such file or directory

slightly better obfs

not sure how much better this is but if you change the ouput from eval to heredoc it doesn't spit out the whole script during tracing at least on first approach, like this:

set +x ### I am annoyng
z="varsblabla"
exec bash <<< "$varsblabla"

Make a deobfusicator

Please make a deobfusicator

[REQ] Add support for openssl encryption

I know it supports base64 encoding, but I think adding support for openssl encryption is a good idea.

Add ability to base64-encode strings

The obfuscator should allow users to further obfuscate their scripts by base64 encoding each chunk. This has the effect of making each chunk less human-readable.

It's easy to deobfuscate

Replace eval to echo, now it's work

Chunk replace should move before this line

node-bash-obfuscate/lib/obfuscate.js

Line 49 in eb931fd

if(chunk in table) return '$' + table[chunk];

In case single quote exist in chunk, original chunk will be changed. Table mapping is based changed chunk content. While in beginning, still use original chunk to check if chunk already exist in table.
Eg. Chunk is ', after replace, chunk is ''. In mapping table, id = ''. In case next chunk still is ', it can't be found in table and will be mapping to another id, original id will lost.
Solution is move line 51 before line 49