How to Encrypt Your Bash Shell Script on Linux Using SHC

Encryption is the most important part in network security. To encrypt our bash shell script in linux we can use SHC which stands for shell script compiler. By the SCH you can encrypt your bash shell script.

1. Download shc and install it

Download shc and install it as shown below.

# wget
# tar xvfz shc-3.8.7.tgz
# cd shc-3.8.7
# make

Verify that shc is installed properly.

$ ./shc -v
shc parse(-f): No source file specified

shc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script

2. Create a Sample Shell Script

Create a sample bash shell script that you like to encrypt using shc for testing purpose.

For testing purpose, let us create the following shell script which generates random numbers. You have to specify how many random numbers you like to generate.

$ vi

echo “Hello How are you Ashish”

$ ./
Hello How are you Ashish

3. Encrypt the Shell Script Using shc

Encrypt the shell scripting using shc as shown below.

$ ./shc -f
This will create the following two files:

$ ls -l*
-rwxrw-r–. 1 ashish ashish 149 Mar 27 01:09
-rwx-wx–x. 1 ashish ashish 11752 Mar 27 01:12
-rw-rw-r–. 1 ashish ashish 10174 Mar 27 01:12 is the original unencrypted shell script is the encrypted shell script in binary format is the C source code of the file. This C source code is compiled to create the above encrypted file. The whole logic behind the shc is to convert the shell script to C program (and of course compile that to generate the executable)

$ file Bourne-Again shell script text executable

$ file ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped

$ file ASCII C program text

4. Execute the Encrypted Shell Script

Now, let us execute the encrypted shell script to make sure it works as expected.

$ ./
Hello How are you Ashish

Please note that the binary itself is still dependent on the shell (the first line provided in the i.e /bin/bash) to be available to execute the script.

5. Specifying Expiration Date for Your Shell Script

Using shc you can also specify an expiration date. i.e After this expiration date when somebody tries to execute the shell script, they’ll get an error message.

Let us say that you don’t want anybody to execute the after 31-Dec-2014 (I used last year date for testing purpose).

Create a new encrypted shell script using “shc -e” option to specify expiration date. The expiration date is specified in the dd/mm/yyyy format.

$ ./shc -e 31/12/2014 -f
In this example, if someone tries to execute the, after 31-Dec-2014, they’ll get a default expiration message as shown below.

$ ./
./ has expired!
Please contact your provider
If you like to specify your own custom expiration message, use -m option (along with -e option as shown below).

$ ./shc -e 31/12/2014 -m “Contact for new version of this script” -f

$ ./
./ has expired!
Contact for new version of this script

6. Create Redistributable Encrypted Shell Scripts

Apart from -e, and -m (for expiration), you can also use the following options:

-r will relax security to create a redistributable binary that executes on other systems that runs the same operating system as the one on which it was compiled.
-T will allow the created binary files to be traceable using programs like strace, ltrace, etc.
-v is for verbose
Typically you might want to use both -r and -T option to craete a redistributable and tracable shell encrypted shell script as shown below.

$ ./shc -v -r -T -f
shc shll=bash
shc [-i]=-c
shc [-x]=exec ‘%s’ “$@”
shc [-l]=
shc opts=
shc: cc -o
shc: strip
shc: chmod go-r linux.x

$ ./
Hello How are you Ashish

Finally, it is worth repeating again: You should not be encrypting your shell script in the first place. But, if you decided to encrypt your shell script using shc, please remember that a smart person can still generate the original shell script from the encrypted binary that was created by shc.

Leave a Reply