{"id":25405939,"url":"https://github.com/h0ny/MobaXtermDecryptor","last_synced_at":"2025-10-31T01:31:45.872Z","repository":{"id":233308271,"uuid":"786843186","full_name":"h0ny/MobaXtermDecryptor","owner":"h0ny","description":"A simple MobaXterm password extraction tool.","archived":false,"fork":false,"pushed_at":"2024-08-08T11:18:29.000Z","size":28,"stargazers_count":10,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-08-09T12:15:44.913Z","etag":null,"topics":["decryption","mobaxterm","recovery","redteam"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/h0ny.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-04-15T12:11:28.000Z","updated_at":"2024-08-09T12:15:44.914Z","dependencies_parsed_at":"2024-04-15T18:09:38.612Z","dependency_job_id":"eacca316-1a7e-4311-a0df-b55ea24c4303","html_url":"https://github.com/h0ny/MobaXtermDecryptor","commit_stats":null,"previous_names":["h0ny/mobaxtermdecryptor"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h0ny%2FMobaXtermDecryptor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h0ny%2FMobaXtermDecryptor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h0ny%2FMobaXtermDecryptor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h0ny%2FMobaXtermDecryptor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/h0ny","download_url":"https://codeload.github.com/h0ny/MobaXtermDecryptor/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239088377,"owners_count":19579434,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["decryption","mobaxterm","recovery","redteam"],"created_at":"2025-02-16T05:03:15.769Z","updated_at":"2025-10-31T01:31:45.587Z","avatar_url":"https://github.com/h0ny.png","language":"C#","funding_links":[],"categories":["C# #"],"sub_categories":[],"readme":"## MobaXtermDecryptor\n\n[![Author](https://img.shields.io/badge/author-h0ny-red.svg \"Author\")](https://github.com/h0ny \"Author\")\n[![Visitors](https://visitor-badge.laobi.icu/badge?page_id=h0ny.MobaXtermDecryptor \"Visitors\")](https://github.com/h0ny/MobaXtermDecryptor \"Visitors\")\n[![Stars](https://img.shields.io/github/stars/h0ny/MobaXtermDecryptor.svg?style=flat \"Stars\")](https://github.com/h0ny/MobaXtermDecryptor \"Stars\")\n![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/h0ny/MobaXtermDecryptor/total?color=orange)\n[![GitHub Release](https://img.shields.io/github/v/release/h0ny/MobaXtermDecryptor)](https://github.com/h0ny/MobaXtermDecryptor/releases)\n![GitHub License](https://img.shields.io/github/license/h0ny/MobaXtermDecryptor)\n\n### 介绍\n\n一个简单的 MobaXterm 密码转储工具。\n\n---\n\n用户凭据存储的位置：\n\n| Registry Path                     | Registry Entry         | MobaXterm.ini | Description              |\n| --------------------------------- | ---------------------- | ------------- | ------------------------ |\n| HKCU\\Software\\Mobatek\\MobaXterm   | SessionP               | [Misc]        | Entropy (DPAPI)          |\n| HKCU\\Software\\Mobatek\\MobaXterm\\M | UserName@MachineName   | [Sesspass]    | MasterPassword (base64)  |\n| HKCU\\Software\\Mobatek\\MobaXterm\\P | [All Registry Entries] | [Passwords]   | Passwords (ciphertext)   |\n| HKCU\\Software\\Mobatek\\MobaXterm\\C | [All Registry Entries] | [Credentials] | Credentials (ciphertext) |\n\n部分 MobaXterm.ini 内容示例：\n\n```ini\n[Misc]\nSessionP=656078197542\nMPSetAccount=Administrator\nMPSetComputer=WIN-KC7O8UA7U4Q\n\n[Credentials]\ndev-user=root:hDkUY2nK\n\n[Passwords]\nmobauser@mobaserver=hnp+7YZCxO75h1e/w1tST2IvKHtWIIIRuKQ=\n\n[Sesspass]\nAdministrator@WIN-Demo=AQAAALK+kjnRao9Fp9ljPL2GpQIAAAAAAgAAAAAAEGYAAAABAAAgAAAA8eEio3ElndSDHvad+IUTeuDcxECIp6BRTcnl4WUO0hQAAAAADoAAAAACAAAgAAAApYkVRexqVUB0W2aggCLirnpVr7XXvG4zkThBB5Cc34RgAAAAtuRBDfbxi9Ws5Fp7D2DAV12a/7+ZAC4Y8s6LryB0AmG6eByh2+ScguKs0nKsXupoHtQrq1esdbOF+KA5ObYKv7e9Cmb3X86HX90sRyaqRoi0faQ4BwL2EVFP3CAqNfVCQAAAAOIiPQ/546VgLw5vn2ptgn/ELHzOiGWwA7v9ov3Z0/POZrPXW+1jtb2PeGCkWyH82PDjx5c0UyO4j7xw/UzrDYE=\n```\n\n### 使用方法\n\n对于 MobaXterm 安装版本直接运行即可：\n\n```\nPS C:\\\u003e .\\MobaXtermDecryptor.exe --debug\n[14:48:54 INF] [+] Logger initialized with level: Debug\n[14:48:54 INF] [+] Automatic mode\n[14:48:55 DBG] [+] Searching for MobaXterm process:\n[14:48:55 DBG] [+]   Process Name: MobaXterm, Version: 24.2\n[14:48:55 DBG] [+]   Process ID: 2448, Path: C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\n[14:48:55 DBG] [-] MobaXterm.ini configuration file does not exist: C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.ini\n[14:48:55 DBG] [+] Read information from the registry: HKEY_CURRENT_USER\\Software\\Mobatek\\MobaXterm\\\n[14:48:55 INF] [+] MobaXterm Installer Edition\n[14:48:55 INF] [+] MobaXterm Credentials:\n[14:48:55 INF] [*]   Name:     dev-user\n[14:48:55 INF] [*]   Username: root\n[14:48:55 INF] [*]   Password: Admin123\n[14:48:55 INF] [*]\n[14:48:55 INF] [+] MobaXterm Passwords:\n[14:48:55 INF] [*]   ConnName: mobauser@mobaserver\n[14:48:55 INF] [*]   Password: 39214moba204877pass6472\n[14:48:55 INF] [*]\n```\n\n对于 MobaXterm 便携版本需要指定 MobaXterm.ini 文件：\n\n```\nPS C:\\\u003e .\\MobaXtermDecryptor.exe mobaxterm --debug c:\\Users\\Administrator\\Documents\\MobaXterm\\MobaXterm.ini\n[14:38:32 INF] [+] Logger initialized with level: Debug\n[14:38:32 INF] [+] Execute mobaxterm command\n[14:38:33 INF] [+] MobaXterm.ini configuration file path: c:\\Users\\hony\\Documents\\MobaXterm\\MobaXterm.ini\n[14:38:33 INF] [+] MobaXterm Portable Edition\n[14:38:33 INF] [+] MobaXterm Credentials:\n[14:38:33 INF] [*]   Name:     dev-user\n[14:38:33 INF] [*]   Username: root\n[14:38:33 INF] [*]   Password: Admin123\n[14:38:33 INF] [*]\n[14:38:33 INF] [+] MobaXterm Passwords:\n[14:38:33 INF] [*]   ConnName: mobauser@mobaserver\n[14:38:33 INF] [*]   Password: 100374moba240717pass345585\n[14:38:33 INF] [*]\n```\n\n\u003e 注意：对于便携版也需要在目标机器上运行，因为有进行 DPAPI 解密操作。\n\n### 参考项目\n\n- https://github.com/qwqdanchun/Pillager\n- https://github.com/XMCyber/XMCredentialsDecryptor\n- https://github.com/HyperSine/how-does-MobaXterm-encrypt-password\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh0ny%2FMobaXtermDecryptor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fh0ny%2FMobaXtermDecryptor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh0ny%2FMobaXtermDecryptor/lists"}