跳至主要內容

Finalshell

程序员李某某大约 2 分钟

Finalshell

Session.connect: java.net.SocketException: Connection reset

  • 把ip先改错,连一次
  • 再改回来

找回密码

  • 从Finalshell中导出配置的json,使用下面程序解码
javac -encoding UTF-8 -d . .\FinalShellDecodePass.java
# -d . 解决找不到主类的问题
# -encoding UTF-8 解决 编码 GBK 的不可映射字符 (0xB2)的问题

程序如下:

import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.Random;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;

/**
 * 在Finalshell中导出配置的json,使用本程序解码
 */
public class FinalShellDecodePass {
    public static void main(String[] args) throws Exception {
        // 错误1: 找不到或无法加载主类 .\FinalShellDecodePass.class 原因:
        //      java.lang.ClassNotFoundException: /\FinalShellDecodePass/class
        // 解决方法:编译时,javac -d . .\FinalShellDecodePass.java

        // 运行错误2:
        // .\FinalShellDecodePass.java:18: 错误: 编码 GBK 的不可映射字符 (0xB2)
        // System.out.println(decodePass("鏇挎崲鎴愪笂闈㈠鍒剁殑瀛楃涓?"));
        // javac -encoding UTF-8 .\FinalShellDecodePass.java
        // System.out.println(decodePass("替换成上面复制的字符串"));
        System.out.println(decodePass("VBJfID8LN0yqrelUBz8z8w=="));
    }

    public static byte[] desDecode(byte[] data, byte[] head) throws Exception {
        SecureRandom sr = new SecureRandom();
        DESKeySpec dks = new DESKeySpec(head);
        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");
        SecretKey securekey = keyFactory.generateSecret(dks);
        Cipher cipher = Cipher.getInstance("DES");
        cipher.init(2, securekey, sr);
        return cipher.doFinal(data);
    }

    public static String decodePass(String data) throws Exception {
        if (data == null) {
            return null;
        } else {
            String rs = "";
            byte[] buf = Base64.getDecoder().decode(data);
            byte[] head = new byte[8];
            System.arraycopy(buf, 0, head, 0, head.length);
            byte[] d = new byte[buf.length - head.length];
            System.arraycopy(buf, head.length, d, 0, d.length);
            byte[] bt = desDecode(d, ranDomKey(head));
            rs = new String(bt);

            return rs;
        }
    }

    static byte[] ranDomKey(byte[] head) {
        long ks = 3680984568597093857L / (long) (new Random((long) head[5])).nextInt(127);
        Random random = new Random(ks);
        int t = head[0];

        for (int i = 0; i < t; ++i) {
            random.nextLong();
        }

        long n = random.nextLong();
        Random r2 = new Random(n);
        long[] ld = new long[] { (long) head[4], r2.nextLong(), (long) head[7], (long) head[3], r2.nextLong(),
                (long) head[1], random.nextLong(), (long) head[2] };
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        DataOutputStream dos = new DataOutputStream(bos);
        long[] var15 = ld;
        int var14 = ld.length;

        for (int var13 = 0; var13 < var14; ++var13) {
            long l = var15[var13];

            try {
                dos.writeLong(l);
            } catch (IOException var18) {
                var18.printStackTrace();
            }
        }

        try {
            dos.close();
        } catch (IOException var17) {
            var17.printStackTrace();
        }

        byte[] keyData = bos.toByteArray();
        keyData = md5(keyData);
        return keyData;
    }

    public static byte[] md5(byte[] data) {
        String ret = null;
        byte[] res = null;

        try {
            MessageDigest m;
            m = MessageDigest.getInstance("MD5");
            m.update(data, 0, data.length);
            res = m.digest();
            ret = new BigInteger(1, res).toString(16);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
        return res;
    }
}
上次编辑于:
贡献者: 李元昊