Skip to content

Commit 4d3f548

Browse files
committed
update
1 parent 2f526c2 commit 4d3f548

3 files changed

Lines changed: 7 additions & 7 deletions

File tree

‎_posts/en/2026-08-08-shc-vs-himitsushell.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ title: "Comparing Shell Script Protection Tools: shc vs HimitsuShell (Binary Com
1212
Now let's walk through the comparison item by item.
1313

1414
## Test Environment
15-
The following shell script is used on Ubuntu 24.04.
15+
The following shell script was tested on Ubuntu 24.04.
1616

1717
![Test shell script](/assets/images/shc-vs-himitsushell/1.png)
1818

@@ -93,7 +93,7 @@ As shown above, there's a clear difference in security strength between shc and
9393

9494
## Additional Comparison
9595
There's also [ssc](https://github.com/liberize/ssc), which improves on shc.
96-
It addresses some of the issues (dynamic library hooking defense, string obfuscation), but still has limitations around advanced obfuscation and OS-level logging/hooking defense.
96+
It addresses some of the issues (protection against dynamic library hooking, string obfuscation), but still has limitations around advanced obfuscation and protection against OS-level logging/hooking.
9797

9898
**Notably, while ssc doesn't depend on the system shell, at runtime it extracts the interpreter (e.g., /bin/sh) to the path /tmp/ssc/XXXXXX and passes the shell script to it. This means logging or hooking that path leaves the shell script vulnerable to extraction.**
9999

‎_posts/en/2026-08-09-shc-security-analysis.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ A binary built with shc runs the shell script by passing it to the system shell
1616
Let's actually test this and confirm the vulnerability.
1717

1818
## Test Environment
19-
The following shell script is used on ubuntu 24.04.
19+
The following shell script was tested on Ubuntu 24.04.
2020

2121
![Shell script used for testing](/assets/images/shc-security-analysis/2.png)
2222

23-
Proceed with [maximum security strength](https://github.com/neurobin/shc/blob/master/man.md) as shown below.
23+
Build the binary at [maximum security level](https://github.com/neurobin/shc/blob/master/man.md) as shown below.
2424

2525
```shell
2626
shc -Uf launcher.sh -o shc_binary

‎_posts/en/2026-08-10-ssc-security-analysis.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ A binary built with ssc briefly drops the embedded shell interpreter (e.g., Busy
1818
Let's test this directly and confirm the vulnerability.
1919

2020
## Test Environment
21-
We'll use the shell script below on ubuntu 24.04.
21+
The following shell script was tested on Ubuntu 24.04.
2222

2323
![Test shell script](/assets/images/ssc-security-analysis/2.png)
2424

25-
We'll proceed with the [shell interpreter (BusyBox) embedded](https://github.com/liberize/ssc/tree/master/examples/4_embed_interpreter) as shown below.
25+
We'll build the binary with the [shell interpreter (BusyBox) embedded](https://github.com/liberize/ssc/tree/master/examples/4_embed_interpreter), as shown below.
2626

2727
```shell
2828
./ssc test ssc_binary -s -r -e busybox -c
@@ -40,7 +40,7 @@ sudo bpftrace -e 'tracepoint:syscalls:sys_enter_write /comm == "ssc_binary"/ { p
4040
./ssc_binary
4141
```
4242

43-
**As shown in the red box in the image below, bpftrace (kernel tracing tool) makes it easy to capture the shell script.**
43+
**As shown in the red box in the image below, bpftrace (a kernel tracing tool) makes it easy to capture the shell script.**
4444

4545
![Terminal 2 monitoring result](/assets/images/ssc-security-analysis/3.png)
4646

0 commit comments

Comments
 (0)