7

I frequently use the do shell script command in AppleScript (AS) to return some information, including encrypted text.

One such example is:

set encrypted to (do shell script "echo 'my secret text' | openssl enc -aes-256-cbc -a -pass pass:Pass123")

If run in Terminal, this command logs in the history and can be viewed by typing: history, then pressing the Return key.

Problem: The above example includes the plain text password as a parameter, and it shows in the history (when run in Terminal), from where it can easily be copied and used to reverse the encrypted string, no knowledge required.

AppleScript's log do shell script "history" command returns no data. Likewise, running the history command in the terminal - after the example encryption was run through AS, it also does not display the AS terminal command in this history. All in all, it leads me to believe that the AS command was obviously executed through a different shell. Knowing that the shell differs for every user (ie. my account cannot see the terminal history of another account), the question follows.

Question: Does that mean there is no record of the AS command in any of the histories and logs kept by macOS at any time? Or is it burried somewhere accessible where it can be read, interpreted and hence the encryption reversed?

Though perhaps thought-provoking and open to opinion, I think it is within the answerable realm of questions. I am interested in the answer from a security point-of-view and hope to get a clearer picture of if / how / where terminal logs AS commands - like Terminal does with the history.
Thanks everyone.

3

If you run the following do shell script command in Script Editor:

do shell script "set"

Shown farther below is what's returned.

As one can see, there are no history related shell variables set and as such, to make a longer story short, there is no command history being saved.

If you want to read further, have a look at the HISTORY section in the bash manual page,

Also may be of interest, other command history Shell Variables e.g., HISTCONTROL, HISTFILE HISTFILESIZE, HISTIGNORE, HISTSIZE, HISTIGNORE, HISTSIZE and HISTTIMEFORMAT.


Also of note, when a Run Shell Script action in an Automator workflow is run, the same applies there as well, for the same reason as with the do shell script command in Script Editor, no history related shell variables are set.


Output of the set command from an AppleScript do shell script command:

Apple_PubSub_Socket_Render=/private/tmp/com.apple.launchd.HPRIi1Tsop/Render
BASH=/bin/sh
BASH_ARGC=()
BASH_ARGV=()
BASH_EXECUTION_STRING=set
BASH_LINENO=()
BASH_SOURCE=()
BASH_VERSINFO=([0]=\"3\" [1]=\"2\" [2]=\"57\" [3]=\"1\" [4]=\"release\" [5]=\"x86_64-apple-darwin17\")
BASH_VERSION='3.2.57(1)-release'
DIRSTACK=()
EUID=501
GROUPS=()
HOME=/Users/me
HOSTNAME=mes-Mac.local
HOSTTYPE=x86_64
IFS='   
'
LOGNAME=me
MACHTYPE=x86_64-apple-darwin17
OPTERR=1
OPTIND=1
OSTYPE=darwin17
PATH=/usr/bin:/bin:/usr/sbin:/sbin
POSIXLY_CORRECT=y
PPID=4330
PS4='+ '
PWD=/
SHELL=/bin/bash
SHELLOPTS=braceexpand:hashall:interactive-comments:posix
SHLVL=1
SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.WQb3vmbYE7/Listeners
TERM=dumb
TMPDIR=/var/folders/w0/lht0h70x06b8hdb5lx474pkc0000gn/T/
UID=501
USER=me
XPC_FLAGS=0x0
XPC_SERVICE_NAME=0
_=sh
__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0
  • HISTORY is a feature of interactive shells. Shell scripts are noninteractive and HISTORY is disabled. Try do shell script "echo $-" in the Script Editor then echo $- in a terminal session. Note the missing "i" when run in the Script Editor. – fd0 Dec 13 '17 at 20:34
  • @fd0, Thank for pointing that out. I edited the answer, however it doesn't change the fact that there is no command line history being saved in this use case. – user3439894 Dec 13 '17 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .