├── RC4.py ├── README.md ├── Xdecrypt.exe └── Xdecrypt.py /RC4.py: -------------------------------------------------------------------------------- 1 | from Crypto.Cipher import ARC4 as rc4cipher 2 | import base64 3 | 4 | 5 | def rc4_algorithm(encrypt_or_decrypt, data, key1): 6 | if encrypt_or_decrypt == "encrypt": 7 | key = bytes(key1, encoding='utf-8') 8 | enc = rc4cipher.new(key) 9 | res = enc.encrypt(data.encode('utf-8')) 10 | res = base64.b64encode(res) 11 | res = str(res,'utf8') 12 | return res 13 | elif encrypt_or_decrypt == "decrypt": 14 | enc = rc4cipher.new(key1) 15 | res = enc.decrypt(data) 16 | res = str(res,'utf8') 17 | return res 18 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Xdecrypt 2 | xshell密码恢复工具，用于读取本地的.xsh文件并解密其中的密码，适用各版本xshell。 3 | 本来是帮别人用python写的解密部分，写完干脆整理一下做个小工具。 4 | ## 使用方法 5 | 1. 打开终端或命令行提示符 6 | 2. 切换到 Xdecrypt.exe 文件所在的目录 7 | 3. 运行命令 Xdecrypt.exe 8 | ``` 9 | D:\Xdecrypt\dist>Xdecrypt.exe 10 | 找到.xsh文件路径：C:/Users/Lenovo/Documents/NetSarang Computer/7/Xshell/Sessions 11 | -------------------- 12 | 找到.xsh文件： 13 | ['新建会话.xsh'] 14 | -------------------- 15 | Host：xxx.xxx.xx.xxx 16 | 用户名：root 17 | 密码：xxxxxxxxxxxxx 18 | -------------------- 19 | 20 | ``` 21 | 当您的.xsh文件不在默认目录时，您可以自行指定目录： 22 | ``` 23 | D:\Xdecrypt\dist>Xdecrypt.exe -p "C:/Users/Lenovo/Documents/NetSarang Computer/7/Xshell/Sessions" 24 | 自定义文件路径：C:/Users/Lenovo/Documents/NetSarang Computer/7/Xshell/Sessions 25 | 找到.xsh文件： 26 | ['新建会话.xsh'] 27 | -------------------- 28 | Host：xxx.xxx.xx.xxx 29 | 用户名：root 30 | 密码：xxxxxxxxx 31 | -------------------- 32 | 33 | ``` 34 | ## 注意 35 | - 本工具仅用于恢复您自己的密码，不得用于非法用途。 36 | - 使用本工具造成的任何后果，均由使用者自行承担。 37 | ## 参考 38 | https://github.com/JDArmy/SharpXDecrypt 39 | https://github.com/HyperSine/how-does-Xmanager-encrypt-password 40 | -------------------------------------------------------------------------------- /Xdecrypt.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/plexming/Xdecrypt/141509507f91a864ad972fd516332eafeafd685b/Xdecrypt.exe -------------------------------------------------------------------------------- /Xdecrypt.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import os 3 | 4 | import RC4 5 | import base64 6 | import hashlib 7 | import win32api 8 | import win32security 9 | import re 10 | 11 | 12 | class Xsh: # .xsh文件中的相关信息 13 | def __init__(self): 14 | self.Host = '' 15 | self.UserName = '' 16 | self.Password = '' 17 | self.encryptPw = '' 18 | self.Version = '' 19 | 20 | 21 | def Xdecrypt(pw, userSID, username, version): # 解密函数 22 | decrypted = '' 23 | if version.startswith('5.0') or version.startswith('4') or version.startswith('3') or version.startswith('2'): 24 | data = base64.b64decode(pw) # base64解码 25 | string_to_hash = "!X@s#h$e%l^l&" 26 | hash_object = hashlib.md5() 27 | hash_object.update(string_to_hash.encode()) 28 | key = hash_object.digest() # md5加密 29 | pass_data = data[:(len(data) - 32)] 30 | decrypted = RC4.rc4_algorithm('decrypt', pass_data, key) # RC4加密 31 | elif version.startswith('5.1') or version.startswith('5.2'): 32 | data = base64.b64decode(pw) 33 | hash_object = hashlib.sha256() 34 | hash_object.update(userSID.encode()) 35 | key = hash_object.digest() 36 | pass_data = data[:(len(data) - 32)] 37 | decrypted = RC4.rc4_algorithm('decrypt', pass_data, key) 38 | elif version.startswith('5') or version.startswith('6')or version.startswith('7.0'): 39 | data = base64.b64decode(pw) 40 | hash_object = hashlib.sha256() 41 | hash_object.update(bytes(username + userSID, 'utf-8')) 42 | key = hash_object.digest() 43 | pass_data = data[:(len(data) - 32)] 44 | decrypted = RC4.rc4_algorithm('decrypt', pass_data, key) 45 | elif version.startswith('7'): 46 | str1 = username[::-1] + userSID 47 | str2 = str1[::-1] # 字符串倒序 48 | data = base64.b64decode(pw) # b64解码 49 | hash_object = hashlib.sha256() # sha256编码 50 | hash_object.update(bytes(str2, 'utf-8')) 51 | key = hash_object.digest() 52 | pass_data = data[:(len(data)-32)] 53 | decrypted = RC4.rc4_algorithm('decrypt',pass_data,key) # RC4加密 54 | return decrypted 55 | 56 | 57 | def find_path(): 58 | user = win32api.GetUserName() 59 | path = f"C:/Users/{user}/Documents/NetSarang Computer/7/Xshell/Sessions" 60 | if os.path.exists(path): 61 | print(f"找到.xsh文件路径：{path} ") 62 | print("--------------------") 63 | return path 64 | else: 65 | print("找不到.xsh文件路径") 66 | 67 | 68 | def find_info(path): 69 | username = win32api.GetUserName() # 本地 70 | SID = win32security.LookupAccountName(None, username)[0] 71 | SID = win32security.ConvertSidToStringSid(SID) 72 | fields = ["Password", "UserName", "Host", "Version"] 73 | files = [f for f in os.listdir(path) if f.endswith('.xsh')] 74 | print("找到.xsh文件：") 75 | print(files) 76 | for file in files: 77 | # 读取文件内容 78 | with open(os.path.join(path, file), 'r', encoding='utf-16') as f: 79 | content = f.read() 80 | values = [] 81 | for field in fields: 82 | pattern = fr"{field}=(.*)" 83 | match = re.search(pattern, content) 84 | if match: 85 | values.append(match.group(1)) 86 | else: 87 | values.append("") 88 | # print(values) 89 | xsh = Xsh() 90 | xsh.encryptPw = values[0] 91 | xsh.UserName = values[1] 92 | xsh.Host = values[2] 93 | xsh.Version = values[3] 94 | xsh.password = Xdecrypt(xsh.encryptPw, SID, username, xsh.Version) 95 | print("--------------------") 96 | print("Host：" + xsh.Host) 97 | print("用户名："+xsh.UserName) 98 | print("密码："+xsh.password) 99 | print("--------------------") 100 | 101 | 102 | # Press the green button in the gutter to run the script. 103 | if __name__ == '__main__': 104 | parser = argparse.ArgumentParser() 105 | parser.add_argument('-p', '--path', help='the path of Xshell session file') 106 | args = parser.parse_args() 107 | if args.path: 108 | print(f"自定义文件路径：{args.path}") 109 | find_info(args.path) 110 | else: 111 | path = find_path() 112 | find_info(path) 113 | 114 | --------------------------------------------------------------------------------