1717 */
1818
1919static const char my_name [] = "shc" ;
20- static const char version [] = "Version 4.0.2 " ;
20+ static const char version [] = "Version 4.0.3 " ;
2121static const char subject [] = "Generic Shell Script Compiler" ;
2222static const char cpright [] = "GNU GPL Version 3" ;
2323static const struct { const char * f , * s , * e ; }
@@ -147,6 +147,86 @@ static int BUSYBOXON_flag = 0;
147147
148148static const char * RTC [] = {
149149"" ,
150+ "#if HARDENING" ,
151+ "static const char * shc_x[] = {" ,
152+ "\"/*\"," ,
153+ "\" * Copyright 2019 - Intika <intika@librefox.org>\"," ,
154+ "\" * Replace ******** with secret read from fd 21\"," ,
155+ "\" * Also change arguments location of sub commands (sh script commands)\"," ,
156+ "\" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl\"," ,
157+ "\" */\"," ,
158+ "\"\"," ,
159+ "\"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */\"," ,
160+ "\"#define PLACEHOLDER \\\"********\\\"\"," ,
161+ "\"#include <dlfcn.h>\"," ,
162+ "\"#include <stdlib.h>\"," ,
163+ "\"#include <string.h>\"," ,
164+ "\"#include <unistd.h>\"," ,
165+ "\"#include <stdio.h>\"," ,
166+ "\"#include <signal.h>\"," ,
167+ "\"\"," ,
168+ "\"static char secret[128000]; //max size\"," ,
169+ "\"typedef int (*pfi)(int, char **, char **);\"," ,
170+ "\"static pfi real_main;\"," ,
171+ "\"\"," ,
172+ "\"// copy argv to new location\"," ,
173+ "\"char **copyargs(int argc, char** argv){\"," ,
174+ "\" char **newargv = malloc((argc+1)*sizeof(*argv));\"," ,
175+ "\" char *from,*to;\"," ,
176+ "\" int i,len;\"," ,
177+ "\"\"," ,
178+ "\" for(i = 0; i<argc; i++){\"," ,
179+ "\" from = argv[i];\"," ,
180+ "\" len = strlen(from)+1;\"," ,
181+ "\" to = malloc(len);\"," ,
182+ "\" memcpy(to,from,len);\"," ,
183+ "\" // zap old argv space\"," ,
184+ "\" memset(from,'\\\\0',len);\"," ,
185+ "\" newargv[i] = to;\"," ,
186+ "\" argv[i] = 0;\"," ,
187+ "\" }\"," ,
188+ "\" newargv[argc] = 0;\"," ,
189+ "\" return newargv;\"," ,
190+ "\"}\"," ,
191+ "\"\"," ,
192+ "\"static int mymain(int argc, char** argv, char** env) {\"," ,
193+ "\" //fprintf(stderr, \\\"Inject main argc = %d\\\\n\\\", argc);\"," ,
194+ "\" return real_main(argc, copyargs(argc,argv), env);\"," ,
195+ "\"}\"," ,
196+ "\"\"," ,
197+ "\"int __libc_start_main(int (*main) (int, char**, char**),\"," ,
198+ "\" int argc,\"," ,
199+ "\" char **argv,\"," ,
200+ "\" void (*init) (void),\"," ,
201+ "\" void (*fini)(void),\"," ,
202+ "\" void (*rtld_fini)(void),\"," ,
203+ "\" void (*stack_end)){\"," ,
204+ "\" static int (*real___libc_start_main)() = NULL;\"," ,
205+ "\" int n;\"," ,
206+ "\"\"," ,
207+ "\" if (!real___libc_start_main) {\"," ,
208+ "\" real___libc_start_main = dlsym(RTLD_NEXT, \\\"__libc_start_main\\\");\"," ,
209+ "\" if (!real___libc_start_main) abort();\"," ,
210+ "\" }\"," ,
211+ "\"\"," ,
212+ "\" n = read(21, secret, sizeof(secret));\"," ,
213+ "\" if (n > 0) {\"," ,
214+ "\" int i;\"," ,
215+ "\"\"," ,
216+ "\" if (secret[n - 1] == '\\\\n') secret[--n] = '\\\\0';\"," ,
217+ "\" for (i = 1; i < argc; i++)\"," ,
218+ "\" if (strcmp(argv[i], PLACEHOLDER) == 0)\"," ,
219+ "\" argv[i] = secret;\"," ,
220+ "\" }\"," ,
221+ "\"\"," ,
222+ "\" real_main = main;\"," ,
223+ "\"\"," ,
224+ "\" return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);\"," ,
225+ "\"}\"," ,
226+ "\"\"," ,
227+ "0};" ,
228+ "#endif /* HARDENING */" ,
229+ "" ,
150230"/* rtc.c */" ,
151231"" ,
152232"#include <sys/stat.h>" ,
@@ -281,26 +361,51 @@ static const char * RTC[] = {
281361"} " ,
282362"/* End Seccomp Sandboxing Init */" ,
283363"" ,
364+ "void shc_x_file() {" ,
365+ " FILE *fp;" ,
366+ " int line = 0;" ,
367+ "" ,
368+ " if ((fp = fopen(\"/tmp/shc_x.c\", \"w\")) == NULL ) {exit(1); exit(1);}" ,
369+ " for (line = 0; shc_x[line]; line++) fprintf(fp, \"%s\\n\", shc_x[line]);" ,
370+ " fflush(fp);fclose(fp);" ,
371+ "}" ,
372+ "" ,
373+ "int make() {" ,
374+ " char * cc, * cflags, * ldflags;" ,
375+ " char cmd[4096];" ,
376+ "" ,
377+ " cc = getenv(\"CC\");" ,
378+ " if (!cc) cc = \"cc\";" ,
379+ "" ,
380+ " sprintf(cmd, \"%s %s -o %s %s\", cc, \"-Wall -fpic -shared\", \"/tmp/shc_x.so\", \"/tmp/shc_x.c -ldl\");" ,
381+ " if (system(cmd)) {remove(\"/tmp/shc_x.c\"); return -1;}" ,
382+ " remove(\"/tmp/shc_x.c\"); return 0;" ,
383+ "}" ,
384+ "" ,
284385"void arc4_hardrun(void * str, int len) {" ,
285386" //Decode locally" ,
286387" char tmp2[len];" ,
388+ " char tmp3[len+1024];" ,
287389" memcpy(tmp2, str, len);" ,
288390"" ,
289391" unsigned char tmp, * ptr = (unsigned char *)tmp2;" ,
290- "" ,
291392" int lentmp = len;" ,
292393" int pid, status;" ,
293394" pid = fork();" ,
294- "" ,
395+ "" ,
396+ " shc_x_file();" ,
397+ " if (make()) {exit(1);}" ,
398+ "" ,
399+ " setenv(\"LD_PRELOAD\",\"/tmp/shc_x.so\",1);" ,
400+ "" ,
295401" if(pid==0) {" ,
296402"" ,
297403" //Start tracing to protect from dump & trace" ,
298404" if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {" ,
299- " printf(\"Operation not permitted\\n\");" ,
300405" kill(getpid(), SIGKILL);" ,
301406" _exit(1);" ,
302407" }" ,
303- "" ,
408+ "" ,
304409" //Decode Bash" ,
305410" while (len > 0) {" ,
306411" indx++;" ,
@@ -314,25 +419,29 @@ static const char * RTC[] = {
314419" len--;" ,
315420" }" ,
316421"" ,
317- " //Exec bash script" ,
422+ " //Do the magic" ,
423+ " sprintf(tmp3, \"%s %s\", \"'********' 21<<<\", tmp2);" ,
424+ "" ,
425+ " //Exec bash script //fork execl with 'sh -c'" ,
318426" system(tmp2);" ,
319427"" ,
320428" //Empty script variable" ,
321429" memcpy(tmp2, str, lentmp);" ,
322430"" ,
431+ " //Clean temp" ,
432+ " remove(\"/tmp/shc_x.so\");" ,
433+ "" ,
323434" //Sinal to detach ptrace" ,
324435" ptrace(PTRACE_DETACH, 0, 0, 0);" ,
325436" exit(0);" ,
326437" }" ,
327- " else {" ,
328- " wait(&status);" ,
329- " }" ,
438+ " else {wait(&status);}" ,
330439"" ,
331440" /* Seccomp Sandboxing - Start */" ,
332441" seccomp_hardening();" ,
333442"" ,
334443" exit(0);" ,
335- "} " ,
444+ "}" ,
336445"#endif /* HARDENING */" ,
337446"" ,
338447"/*" ,
0 commit comments