渗透工具SharpXDecrypt：Xshell全版本凭证一键恢复工具，针对Xshell全版本在本地保存的密码进行解密

Git地址：

JDArmy/SharpXDecrypt: Xshell全版本密码恢复工具 (github.com)

声明

本程序仅供个人恢复密码使用，如果代码中存在侵权行为，请联系我们删除。

简介

Xshell全版本凭证一键恢复工具，针对Xshell全版本在本地保存的密码进行解密，包括最新的7系列版本！

使用方法

cmd.exe 自动寻找session路径

C:\Users\asus\Desktop\DEV\SharpXDecrypt\bin\Debug> .\SharpXDecrypt.exeXshell全版本凭证一键导出工具!(支持最新Xshell 7系列版本!)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading![*] Start GetUserPath....UserPath: E:\NetSarang Computer\xshell6UserPath: C:\Users\asus\Documents\NetSarang Computer\7
[*] Get UserPath Success ![*] Start GetUserSID....Username: asususerSID: S-1-5-21-736521517-423******97-1340300005-1001
[*] GetUserSID Success !XSHPath: E:\NetSarang Computer\xshell6\Xshell\Sessions\192.168.1.110.xshHost: 192.168.1.110UserName: wwwuserPassword: www*******AqxVersion: 6.0XSHPath: C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions\192.168.1.110.xshHost: 192.168.1.110UserName: wwwuserPassword: ww********AqxVersion: 7.1XSHPath: C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions\Tokyo.xshHost: 198.13.51.134UserName: rootPassword: W8*********PN__%Version: 7.1

cmd.exe 指定session路径

C:\Users\asus\Desktop\DEV\SharpXDecrypt\bin\Release> .\SharpXDecrypt.exe "C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions"Xshell全版本凭证一键导出工具!(支持Xshell 7.0+版本)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading![*] Start GetUserSID....Username: asususerSID: S-1-5-21-736521517-4232353097-1340300005-1001
[*] GetUserSID Success !XSHPath: C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions\192.168.1.110.xshHost: 192.168.1.110UserName: wwwuserPassword: www*******qxVersion: 7.1XSHPath: C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions\新建会话.xshHost: 127.0.0.1UserName: rootPassword: 78******6Version: 7.1[*] read done!

Cobalt Strike

execute-assembly /path/to/SharpXDecrypt.exe
execute-assembly /path/to/SharpXDecrypt.exe  "C:\Users\asus\Documents\NetSarang Computer\7\Xshell\Sessions"

更新日志

v0.1.0, 2022-02-22, 创建
v0.1.1, 2022-02-23, 修复中文用户名解密失败问题
v0.1.2, 2022-02-23, 修复Xshell5执行报错问题，增加指定session路径功能
v0.1.3, 2022-02-25, 修复7.0版本解密问题
v0.1.4, 2022-03-02, 处理UserDataPath获取失败后程序异常终止问题。

致谢

暂无

参考

GitHub - HyperSine/how-does-Xmanager-encrypt-password: This is a repo to tell you how Xmanager (XFtp, XShell) encrypt password. Transferred from https://github.com/DoubleLabyrinth/how-does-Xmanager-encrypt-password

GitHub - uknowsec/SharpDecryptPwd: 对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。源码：https://github.com/RowTeam/SharpDecryptPwd