python3逆向Xshell的密码
在别人的基础上改了。增加兼容性，易用性。
# coding=utf-8
#pip3 install pycryptodome
#pip3 install pywin32
#
import os
import argparse
import base64
import configparser
import sys
import win32con,win32api
from win32api import GetComputerName, GetUserName
from win32security import LookupAccountName, ConvertSidToStringSid
from Crypto.Hash import SHA256
from Crypto.Cipher import ARC4
def decrypt_string(a1, a2):
#print(a2)
v1 = base64.b64decode(a2)
#print(v1)
v3 = ARC4.new(SHA256.new(a1.encode('ascii')).digest()).decrypt(v1[:len(v1) - 0x20])
if SHA256.new(v3).digest() == v1[-32:]:
return v3.decode('ascii')
else:
return None
def GetPath():
path=os.path.join(os.environ["USERPROFILE"], r"Documents\NetSarang Computer\6")
if not os.path.exists(path):
reg_root = win32con.HKEY_CURRENT_USER
reg_path = r"Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
reg_flags = win32con.WRITE_OWNER|win32con.KEY_WOW64_64KEY|win32con.KEY_ALL_ACCESS
key = win32api.RegOpenKeyEx(reg_root, reg_path, 0, reg_flags)
value,key_type = win32api.RegQueryValueEx(key, 'Personal')
path=value+"\\NetSarang Computer\\6\\Xshell\\Sessions"
return path
sid = GetUserName() + ConvertSidToStringSid(LookupAccountName(GetComputerName(), GetUserName())[0])
password=GetPath()
if not os.path.isdir(password):
r = decrypt_string(sid, password)
if r:
print(r)
for root, dirs, files in os.walk(password):
for f in files:
if f.endswith(".xsh") or f.endswith(".xfp"):
filepath = os.path.join(root, f)
cfg = configparser.ConfigParser()
try:
cfg.read(filepath)
except UnicodeDecodeError:
cfg.read(filepath, encoding="utf-16")
try:
if f.endswith(".xsh"):
host = "{}:{}".format(cfg["CONNECTION"]["Host"], cfg["CONNECTION"]["Port"])
username = cfg["CONNECTION:AUTHENTICATION"]["UserName"]
password = decrypt_string(sid, cfg["CONNECTION:AUTHENTICATION"]["Password"])
else:
host = "{}:{}".format(cfg["Connection"]["Host"], cfg["Connection"]["Port"])
username = cfg["Connection"]["UserName"]
password = decrypt_string(sid, cfg["Connection"]["Password"])
print(f"{filepath:=^100}\nHost: {host}\nUsername: {username}\nPassword: {password}")
except Exception as e:
print(f"{filepath:=^100}\nError:{e}")