最近网友安装pptp vpn，到网上找了个脚本，我下下来Sublime Text3用看了下，代码第44行是乱码，因为代码后面被加密了，不过看加密的方式，使用gzexe加密的，其实就是被gzexe压缩了而已，网上看了下，用于加密的shell代码，很长，打算过段时间再写代码分析，这次就直接采用爆破的方式来直接得到解密后的shell脚本代码。
有兴趣的可以看下：这个用来加密其他脚本的shell脚本：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
|
#!/bin/sh
# gzexe: compressor for Unix executables.
# Use this only for binaries that you do not use frequently.
#
# The compressed version is a shell script which decompresses itself after
# skipping $skip lines of shell commands. We try invoking the compressed
# executable with the original name (for programs looking at their name).
# We also try to retain the original file permissions on the compressed file.
# For safety reasons, gzexe will not create setuid or setgid shell scripts.
# WARNING: the first line of this file must be either : or #!/bin/sh
# The : is required for some old versions of csh.
# On Ultrix, /bin/sh is too buggy, change the first line to: #!/bin/sh5
# Copyright (C) 1998, 2002, 2004, 2006, 2007 Free Software Foundation
# Copyright (C) 1993 Jean-loup Gailly
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
tab=‘ ‘
nl=‘
‘
IFS=” tabnl”
version=‘gzexe (gzip) @VERSION@
Copyright (C) 2007 Free Software Foundation, Inc.
This is free software. You may redistribute copies of it under the terms of
the GNU General Public License <http://www.gnu.org/licenses/gpl.html>.
There is NO WARRANTY, to the extent permitted by law.
Written by Jean–loup Gailly.‘
usage=“Usage: $0 [OPTION] FILE...
Rename each FILE with a compressed version of itself, renaming FILE to FILE~.
–d Decompress each FILE instead of compressing it.
—help display this help and exit
—version output version information and exit
Report bugs to <bug–gzip@gnu.org>.“
PATH=“BINDIR:$PATH”
decomp=0
res=0
while :; do
case $1 in
–d) decomp=1; shift;;
—h*) exec echo “$usage”;;
—v*) exec echo “$version”;;
—) shift; break;;
*) break;;
esac
done
if test $# -eq 0; then
echo >&2 “$0: missing operand
Try \`$0 —help‘ for more information.“
exit 1
fi
tmp=
trap ‘res=$?
test –n “$tmp” && rm –f “$tmp”
(exit $res); exit $res
‘ 0 1 2 3 5 10 13 15
mktemp_status=
for i do
case $i in
–*) file=./$i;;
*) file=$i;;
esac
if test ! –f “$file” || test ! –r “$file”; then
res=$?
echo >&2 “0:i is not a readable regular file”
continue
fi
if test $decomp –eq 0; then
if sed –e 1d –e 2q “$file” | grep “^skip=[0-9][0-9]*$” >/dev/null; then
echo >&2 “0:i is already gzexe’d”
continue
fi
fi
if test –u “$file”; then
echo >&2 “0:i has setuid permission, unchanged”
continue
fi
if test –g “$file”; then
echo >&2 “0:i has setgid permission, unchanged”
continue
fi
case /$file in
*/basename | */bash | */cat | */chmod | */cp | \
*/dirname | */echo | */expr | */gzip | \
*/ln | */mkdir | */mktemp | */mv | */rm | \
*/sed | */sh | */sleep | */test | */tail)
echo >&2 “0:i might depend on itself”; continue;;
esac
dir=`dirname “$file”` || dir=$TMPDIR
test –d “$dir” && test –w “$dir” && test –x “$dir” || dir=/tmp
test –n “$tmp” && rm –f “$tmp”
if test –z “$mktemp_status”; then
type mktemp >/dev/null 2>&1
mktemp_status=$?
fi
if test $mktemp_status –eq 0; then
tmp=`TMPDIR=$dir mktemp –t gzexeXXXXXX`
else
tmp=$dir/gzexe$$
fi && { cp –p “$file” “$tmp” 2>/dev/null || cp “$file” “$tmp”; } || {
res=$?
echo >&2 “0: cannot copyfile”
continue
}
if test –w “$tmp”; then
writable=1
else
writable=0
chmod u+w “$tmp” || {
res=$?
echo >&2 “0: cannot chmodtmp”
continue
}
fi
if test $decomp –eq 0; then
(cat <<‘EOF’ &&
#!/bin/sh
skip=44
tab=‘ ‘
nl=‘
‘
IFS=” tabnl”
umask=`umask`
umask 77
gztmpdir=
trap ‘res=$?
test –n “$gztmpdir” && rm –fr “$gztmpdir”
(exit $res); exit $res
‘ 0 1 2 3 5 10 13 15
if type mktemp >/dev/null 2>&1; then
gztmpdir=`mktemp –dt`
else
gztmpdir=/tmp/gztmp$$; mkdir $gztmpdir
fi || { (exit 127); exit 127; }
gztmp=$gztmpdir/$0
case $0 in
–* | */*‘
‘) mkdir –p “$gztmp” && rm –r “$gztmp”;;
*/*) gztmp=$gztmpdir/`basename “$0”`;;
esac || { (exit 127); exit 127; }
case `echo X | tail –n +1 2>/dev/null` in
X) tail_n=–n;;
*) tail_n=;;
esac
if tail $tail_n +$skip <“$0” | gzip –cd > “$gztmp”; then
umask $umask
chmod 700 “$gztmp”
(sleep 5; rm –fr “$gztmpdir”) 2>/dev/null &
“$gztmp” ${1+“$@”}; res=$?
else
echo >&2 “Cannot decompress $0”
(exit 127); res=127
fi; exit $res
EOF
gzip –cv9 “$file”) > “$tmp” || {
res=$?
echo >&2 “0: compression not possible fori, file unchanged.”
continue
}
else
# decompression
skip=44
skip_line=`sed –e 1d –e 2q “$file”` #http://www.dabu.info/?p=4403
case $skip_line in
skip=[0–9] | skip=[0–9][0–9] | skip=[0–9][0–9][0–9])
eval “$skip_line”;;
esac
case `echo X | tail –n +1 2>/dev/null` in
X) tail_n=–n;;
*) tail_n=;;
esac
tail $tail_n +$skip “$file” | gzip –cd > “$tmp” || {
res=$?
echo >&2 “0:i probably not in gzexe format, file unchanged.”
continue
}
fi
test $writable –eq 1 || chmod u–w “$tmp” || {
res=$?
echo >&2 “0:tmp: cannot chmod”
continue
}
ln –f “$file” “$file~” || {
res=$?
echo >&2 “0: cannot backupi as $i~” #http://www.dabu.info/?p=4403
continue
}
mv –f “$tmp” “$file” || {
res=$?
echo >&2 “0: cannot renametmp to $i”
continue
}
tmp=
done
(exit $res); exit $res
|
如果想安装pptp vpn 可以参考我写的《centos6.4安装搭建pptp vpn服务(附pptp vpn 一键安装包)|大步’s blog》
被加密的hot-pptp-vpn-v1.0.6.sh脚本下载地址： 地址一 地址二
开始，我google了下，用网上到处贴的gzexe解压缩命令来还原这个加密的shell脚本
#gzexe -d m hot-pptp-vpn-v1.0.6.sh #http://www.dabu.info/?p=4403
，但是无效，估计是压缩和改名的顺序不同了，我也懒得去看使用的加密代码了，直接走捷径。所以，这算不得真正的解密，因为没把算法给弄出来，不过不难。
思路：因为是通过压缩改名的方式加密shell脚本，所以，必定有个解压的过程，以此得到可执行的shell脚本。但是为什么我们看不到被解密还原的shell脚本呢？那是因为作者在解压执行后，删除了被还原的shell脚本，所以我们找不到。只要我们在删除命令之前，插入一条cat命令，将临时还原的shell脚本导入到a.txt里就可以了。
具体方法如下：#http://www.dabu.info/?p=4403
首先大概了解这个加密脚本的执行过程，因为即使加密了，他其实还是shell脚本，可以加上-x参数，来看加密脚本的执行过程。
我这里被加密的脚本名为：hot-pptp-vpn-v1.0.6.sh 是一个pptp vpn 一键安装脚本，不得不说这脚本的作者，真tm的小气，居然这玩意也加密，而且又用这样简单的方式，还不如不加密，省了麻烦。
#sh -x hot-pptp-vpn-v1.0.6.sh #-x参数是让shell一步一步显示执行过程
运行显示结果如下：
+ skip=44
+ tab=’ ‘
+ nl=’
‘
+ IFS=’
‘
++ umask
+ umask=0022
+ umask 77
+ gztmpdir=
+ trap ‘res=?
test -n “gztmpdir” && rm -fr “gztmpdir”
(exitres); exit res
‘ 0 1 2 3 5 10 13 15
+ type mktemp
++ mktemp -dt
+ gztmpdir=/tmp/tmp.VGXMV11806
+ gztmp=/tmp/tmp.VGXMV11806/hot-pptp-vpn-v1.0.6.sh
+ case0 in
+ case `echo X | tail -n +1 2>/dev/null` in
++ echo X
++ tail -n +1
+ tail_n=-n
+ tail -n +44
+ gzip -cd
+ umask 0022
+ chmod 700 /tmp/tmp.VGXMV11806/hot-pptp-vpn-v1.0.6.sh
+ /tmp/tmp.VGXMV11806/hot-pptp-vpn-v1.0.6.sh
=========================================================================
* Hot CentOs install pptp vpn v1.0.6 Installer.Organized by blog.7QY.Com *
=========================================================================
* *
* This machine system: CentOS release 5.10 (Final) *
* *
*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*
* *
* Tips: Select < 1 > to CentOs 5.x install pptp VPN *
* Tips: Select < 2 > to CentOs 6.x install pptp VPN *
* *
=========================================================================Please input ( 1 or 2 ) to CentOs install pptp vpn
>> Or press Ctrl+C to cancel the installation (Ctrl+C??哄.瑁..?.
Select: (1) CentOs 5.x install pptp vpn | (2) CentOs 6.x install pptp vpn
( 1/2):
直接看到：
+ chmod 700 /tmp/tmp.VGXMV11806/hot-pptp-vpn-v1.0.6.sh
+ /tmp/tmp.VGXMV11806/hot-pptp-vpn-v1.0.6.sh
会将临时解密的shell脚本放到/tmp/tmp.VGXMV11806/目录下，
而找到加密的shell脚本中，修改脚本执行权限的命令想对应的地方：
umask umask
chmod 700 “gztmp” #这行修改临时解密shell脚本为700权限，”gztmp”就是临时解密的shell脚本
(sleep 5; rm -fr “gztmpdir”) 2>/dev/null & #这样就会把执行完后的临时解密shell脚本所在目录删除，”gztmpdir”就是临时目录
“gztmp” {1+”@”}; res=$?
所以，我们将这其中的：
chmod 700 “$gztmp”
改成：
cat “$gztmp” >a.txt
然后再次执行：
#sh hot-pptp-vpn-v1.0.6.sh
就可以在这个当前脚本所在目录看到一个a.txt的文件，就是被解密的shell脚本了。
####################over!!!!###########################################
很简单吧，确实如此。爆破确实容易，但是乐趣也少了很多，过段时间再把这个用于加密的shell脚本代码分析然后贴出来，最近什么都不想做，懒得没话说。
如果有人想完全的通过解压缩来获得原文件，那么我这说下大概的思路:
源代码有个skip变量，等于44。而用vi查看源代码，从第44行开始就是乱码了，说明要从第44行开始导入到另外一个文件中，来解压缩还原。
其中还有tail命令，所以，只要用-x参数稍微分析下，就可以得到完整的还原过程了。
##########################3
对了，忘了贴出解密后的shell脚本了，这个脚本的相关的软件下载地址失效了，不过只要稍微改下就可以用了
如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
|
#! /bin/sh
# copyright by WWW.7QY.COM
system=`cat /etc/redhat–release`
clear
echo “=========================================================================”
echo “* Hot CentOs install pptp vpn v1.0.6 Installer.Organized by blog.7QY.Com *”
echo “=========================================================================”
echo “* *”
echo “* This machine system: $system *”
echo “* *”
echo “*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*”
echo “* *”
echo “* Tips: Select < 1 > to CentOs 5.x install pptp VPN *”
echo “* Tips: Select < 2 > to CentOs 6.x install pptp VPN *”
echo “* *”
echo “=========================================================================”
echo “”
echo ” Please input ( 1 or 2 ) to CentOs install pptp vpn”
echo “>> Or press Ctrl+C to cancel the installation (Ctrl+C退出安装菜单)”
echo ” Select: (1) CentOs 5.x install pptp vpn | (2) CentOs 6.x install pptp vpn”
read –p ” ( 1/2): “ type
if [ “$type” == ‘1’ ]; then
echo “”
echo “CentOs 5.x yum install pptp vpn…”
vpn_username=“user”
echo “Plese input vpn username:”
read –p “(Default Path: user):” vpn_username
if [ “$vpn_username” = “” ]; then
server_ip=“user”
fi
vpn_password=“pass”
echo “Plese input vpn password:”
read –p “(Default Path: pass):” vpn_password
if [ “$vpn_password” = “” ]; then
vpn_password=“pass”
fi
vpn_ip=“ip”
echo “Plese input vpn ip:”
read –p “(Default Path: ip):” vpn_ip
if [ “$vpn_ip” = “” ]; then
vpn_ip=“ip”
fi
get_char()
{
SAVEDSTTY=`stty –g`
stty –echo
stty cbreak
dd if=/dev/tty bs=1 count=1 2> /dev/null
stty –raw
stty echo
stty $SAVEDSTTY
}
echo “”
echo “Press any key to install pptpd vpn…”
char=`get_char`
cd /tmp
yum install –y ppp iptables
wget –c http://tools.7qy.com/vpn.tar.gz
tar xvf vpn.tar.gz
cd vpn
mv pptpd–1.3.4–2.rhel5.i386.rpm pptpd–1.3.4–2.rhel5.i686.rpm
arch=`uname –m`
rpm –ivh pptpd–1.3.4–2.rhel5.$arch.rpm
echo “localip 10.13.0.1” >> /etc/pptpd.conf
echo “remoteip 10.13.0.2-254” >> /etc/pptpd.conf
sed –i ‘s/require-mppe-128/# require-mppe-128/g’ /etc/ppp/options.pptpd
echo “ms-dns 8.8.8.8” >> /etc/ppp/options.pptpd
echo “ms-dns 8.8.4.4” >> /etc/ppp/options.pptpd
echo “vpn_username pptpdvpn_password *” >> /etc/ppp/chap–secrets
sed –i “s/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g” /etc/sysctl.conf
sed –i “s/net.ipv4.tcp_syncookies = 1/# net.ipv4.tcp_syncookies = 1/g” /etc/sysctl.conf
sysctl –p
#vpn_ip=`hostname -i`
iptables –t nat –A POSTROUTING –s 10.13.0.0/24 –o eth0 –j MASQUERADE
iptables –t nat –A POSTROUTING –s 10.13.0.0/24 –j SNAT —to–source $vpn_ip
/etc/init.d/iptables save
/etc/init.d/iptables restart
cd /tmp
rm –rf vpn
rm –rf vpn.tar.gz
/etc/init.d/pptpd start
chkconfig pptpd on
chkconfig iptables on
clear
echo “================================================================================”
echo “* Hot CentOs PPTP VPN Ver.1.0.6 Installer. Organized by 7QY.Com *”
echo “*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*”
echo “* *”
echo “* For more information about Hot CentOs PPTP VPN please visit blog.7qy.com *”
echo “* *”
echo “* vpn server IP: $vpn_ip *”
echo “* Test user: vpn_username / Test pass:vpn_password *”
echo “* *”
echo “================================================================================”
fi
if [ “$type” == ‘2’ ]; then
echo “”
echo “CentOs 6.0 install pptp vpn…”
vpn_username=“user”
echo “Plese input vpn username:”
read –p “(Default Path: user):” vpn_username
if [ “$vpn_username” = “” ]; then
server_ip=“user”
fi
vpn_password=“pass”
echo “Plese input vpn password:”
read –p “(Default Path: pass):” vpn_password #http://www.dabu.info/?p=4403
if [ “$vpn_password” = “” ]; then
vpn_password=“pass”
fi
vpn_ip=“ip”
echo “Plese input vpn ip:”
read –p “(Default Path: ip):” vpn_ip
if [ “$vpn_ip” = “” ]; then
vpn_ip=“ip”
fi
get_char()
{
SAVEDSTTY=`stty –g`
stty –echo
stty cbreak
dd if=/dev/tty bs=1 count=1 2> /dev/null
stty –raw
stty echo
stty $SAVEDSTTY #http://www.dabu.info/?p=4403
}
echo “”
echo “Press any key to install pptpd vpn…”
char=`get_char`
cd /tmp
yum remove –y pptpd ppp
iptables —flush POSTROUTING —table nat
iptables —flush FORWARD
rm –rf /etc/pptpd.conf
rm –rf /etc/ppp
wget –c http://tools.7qy.com/vpn.tar.gz
tar xvf vpn.tar.gz
cd vpn
arch=`uname –m`
yum –y install make libpcap iptables gcc–c++ logrotate tar cpio perl pam tcp_wrappers dkms kernel_ppp_mppe ppp
rpm –Uvh pptpd–1.3.4–2.el6.$arch.rpm
mknod /dev/ppp c 108 0
echo “mknod /dev/ppp c 108 0” >> /etc/rc.local
echo “localip 10.13.0.1” >> /etc/pptpd.conf
echo “remoteip 10.13.0.2-254” >> /etc/pptpd.conf
sed –i ‘s/require-mppe-128/# require-mppe-128/g’ /etc/ppp/options.pptpd
echo “ms-dns 8.8.8.8” >> /etc/ppp/options.pptpd
echo “ms-dns 8.8.4.4” >> /etc/ppp/options.pptpd #http://www.dabu.info/?p=4403
echo “vpn_username pptpdvpn_password *” >> /etc/ppp/chap–secrets
sed –i “s/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g” /etc/sysctl.conf
sed –i “s/net.ipv4.tcp_syncookies = 1/# net.ipv4.tcp_syncookies = 1/g” /etc/sysctl.conf
sysctl –p
#vpn_ip=`hostname -i`;
iptables –t nat –A POSTROUTING –s 10.13.0.0/24 –o eth0 –j MASQUERADE
iptables –t nat –A POSTROUTING –s 10.13.0.0/24 –j SNAT —to–source $vpn_ip
iptables –t nat –A POSTROUTING –s 10.13.0.0/24 –j SNAT —to–source `ifconfig | grep ‘inet addr:’| grep –v ‘127.0.0.1’ | cut –d: –f2 | awk ‘NR==1 { print $1}’`
iptables –A FORWARD –p tcp —syn –s 10.13.0.0/24 –j TCPMSS —set–mss 1356
/etc/init.d/iptables save
/etc/init.d/iptables restart
cd /tmp
rm –rf vpn
rm –rf vpn.tar.gz
/etc/init.d/pptpd start
chkconfig pptpd on
chkconfig iptables on
clear
echo “================================================================================”
echo “* Hot CentOs PPTP VPN Ver.1.0.6 Installer. Organized by 7QY.Com *”
echo “*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*”
echo “* *”
echo “* For more information about Hot CentOs PPTP VPN please visit blog.7qy.com *”
echo “* *”
echo “* vpn server IP: $vpn_ip *”
echo “* Test user: vpn_username / Test pass:vpn_password *”
echo “* http://www.dabu.info/?p=4403 *”
echo “================================================================================”
fi
|
微信扫一扫，打赏作者吧～