kawaii-ghost/decsh

Shell Script to decrypt SHC and SSC

decsh

Shell Script to decrypt SHC and SSC

Due to Android user complaining about shebang because system hiearchy problem, I recommend you to run it via shell instead of treating it as an executable

Usage : sh ./deshc.sh <shc binary>

Example : ./deshc.sh ./shcfiles.sh

Output : shc_binary.dec.sh

Multiple files are supported

SECURITY

This shell script still execute in the machine. I still configuring it by using prlimit --pid <pid> --nofile=X so it can only open the shared library. Give time with sleep 0.01 until it calls execve and then send SIGSTOP signal after that so atleast the shell script isn't running while being decrypted.

How does it work?

SHC

SHC works internally called execve to shell, it decrypted at runtimes and visible via command line args process

eg: /bin/sh -c "decrypted shell"

SSC

SSC works almost same with SHC except the shell reads from file descriptor 3. It visible via fd number 3 on the process

Read my Indonesian writeup here https://medium.com/@kaw411gh0st/membongkar-program-shc-encrypted-shell-script-1d945b76080b

decsh's Issues

Not running on termux

./deshc.sh: 4: playx102-bin: not found
./deshc.sh: 6: kill: No such process

cat: /proc/14416/cmdline: No such file or directory
./deshc.sh: 8: kill: No such process

Isi File $arg.dec.sh kosong

Gw mendapati masalah pada device android dengan menggunakan aplikasi termux sebagai terminalnya, yaitu pada saat gw selesai mengeksekusi scriptnya lalu gw check isi file $arg.dec.sh kosong. Mohon bantuannya