python3 查看 找回 SecureCRT的密码

secureCRT将每个session的配置文件保存在C:\Documents and Settings\Administrator\Application Data\VanDyke下的config文件夹。根据session名找到对应的配置文件。

注意点：

字串转bytes，python 3.5之后，直接用bytes.fromhex

安装pycrypto 2.6.1，参考https://blog.csdn.net/a624806998/article/details/78596543

# -*- coding=utf-8 -*-

#适用python3.6以上
#调用方法 python SecureCRTDecrypt.py 10.87.225.2.ini
#将SecureCRTDecrypt.py文件放在待破解ini文件同一目录中

from Crypto.Cipher import Blowfish
import sys
import re
 
def decrypt(password) :
	str_c1 = '5F B0 45 A2 94 17 D9 16 C6 C6 A2 FF 06 41 82 B7'.replace(' ','')
	str_c2 = '24 A6 3D DE 5B D3 B3 82 9C 7E 06 F4 08 16 AA 07'.replace(' ','')
	c1 = Blowfish.new(bytes.fromhex(str_c1), Blowfish.MODE_CBC, '\x00'*8)
	c2 = Blowfish.new(bytes.fromhex(str_c2), Blowfish.MODE_CBC, '\x00'*8)
	padded = c1.decrypt(c2.decrypt(bytes.fromhex(password))[4:-4])
	padded = str(padded)
	padded = padded[0:padded.find(r'\x00\x00')]
	padded = padded.strip("b'")
	padded = padded.replace(r'\x00','')
	return padded	

REGEX_HOSTNAME = re.compile(r'S:"Hostname"=([^\r\n]*)')
REGEX_PASWORD = re.compile(r'S:"Password"=u([0-9a-f]+)')
REGEX_PORT = re.compile(r'D:"\[SSH2\] Port"=([0-9a-f]{8})')
REGEX_USERNAME = re.compile(r'S:"Username"=([^\r\n]*)')
 
def hostname(x) :
    m = REGEX_HOSTNAME.search(x)
    if m :
        return m.group(1)
    return '???'
 
def password(x) :
    m = REGEX_PASWORD.search(x)
    if m :
        return decrypt(m.group(1))
    return '???'
 
def port(x) :
    m = REGEX_PORT.search(x)
    if m :
        return '-p %d '%(int(m.group(1), 16))
    return ''
 
def username(x) :
    m = REGEX_USERNAME.search(x)
    if m :
        return m.group(1) #+ '@'
    return ''
	
inifile = sys.argv[1]

with open(inifile,'r', encoding='utf-8') as f:
	c = f.read().replace('\x00', '')
	print ("port:{0}\n hostname:{1}\n username:{2}\n password:{3}".format(port(c), hostname(c), username(c),password(c)))