Bash-Obfuscate

Bash-Obfuscate splits a script into short chunks, assigns each chunk to a two-letter variable, and rebuilds the script in one eval of the concatenated variables. Nothing readable is left in the file, and the command that runs is only known at run time. This example rebuilds a small loop that echoes a message. disclude reports the eval of a value assembled from variables as critical.

Credit: Output of Bash-Obfuscate by William Shiao
File: bash_obfuscate.sh (download)
Signals: 1 critical · 0 warn · 0 info
Disclude version: 4.3.0

Source

Hidden characters are shown as ⟨U+…⟩. Each signal below links to its line.

z="";Hz='echo';Gz=''\''';Lz='for ';Qz='; i+';Ez='Node';Cz=''\''I l';Uz='done';Jz='R_VA';Az='USR_';Fz='.js!';Nz=' = 0';Bz='VAR=';Kz='R';Rz='+ ))';Wz=' wor';Iz=' $US';Vz=' "It';Oz='; i ';Sz='; do';Mz='(( i';Tz=' $i';Xz='ks!"';Pz='< 10';Dz='ike ';eval "$Az$Bz$Cz$Dz$Ez$Fz$Gz$z$Hz$Iz$Jz$Kz$z$Lz$Mz$Nz$Oz$Pz$Qz$Rz$Sz$z$Hz$Tz$z$Uz$z$Hz$Vz$Wz$Xz"

Signals

Ordered by severity.

critical dynamic-execution bash_obfuscate.sh:3:1

`eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
eval "$Az$Bz$Cz$Dz$Ez$Fz$Gz$z$Hz$Iz$Jz$Kz$z$Lz$Mz$Nz$Oz$Pz$Qz$Rz$Sz$z$Hz$Tz$z$Uz$z$Hz$Vz$Wz$Xz"
```

Reproduce

Download the file and scan it. Copying it from this page won't work: the hidden characters are shown as markers.

cargo install disclude --version 4.3.0
curl -o bash_obfuscate.sh https://disclude.io/gallery/bash-obfuscate/source
disclude scan --untrusted --severity info bash_obfuscate.sh