破解Navicat 保存的密码

找出加密的密码

• Navicat（11.2.7、12.1.15、15.1.17、16.0.6上述版本均已通过测试）
• 进入注册表进行查询

使用【Win】+ 【R】组合快捷键，快速打开运行命令框，在打开后面键入命令：【Regedit】打开注册表编辑器

文件路径：

计算机\HKEY_CURRENT_USER\SOFTWARE\PremiumSoft\Navicat\Servers\

以Navicat16为例，通过上方路径，找到注册表中存储密码值的位置（如下图），选中要查看密码的连接名称，双击Pwd项，复制对应的值，至此获得了密文

 

 

• Navicat导出（推荐）

以Navicat16为例，菜单栏上点击文件，选择导出连接...，一定要选中导出密码！！！导出格式为*.ncx（该ncx本质上是xml文件，文件中包含连接的全部信息）

注：Navicat11版本没有勾选导出密码选项，直接导出即可；Navicat12+版本要勾选【导出密码】选项！

 

 

 

 解密密文

https://www.nhooo.com/tool/java8/

运行代码

    
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;

public class Main {
    public static void main(String []args) {
        //navicat11解密
        Navicat11Cipher de = new Navicat11Cipher();
        System.out.println(de.decryptString("密文放此处"));
        //navicat12+解密
        Navicat12Cipher de12 = new Navicat12Cipher();
        System.out.println(de12.decryptString("密文放此处"));
    }
    static class Navicat11Cipher {
        public static final String DefaultUserKey = "3DC5CA39";
        private static byte[] _IV;

        private static SecretKeySpec _Key;
        private static Cipher _Encryptor;
        private static Cipher _Decryptor;

        private static void initKey(String UserKey) {
            try {
                MessageDigest sha1 = MessageDigest.getInstance("SHA1");
                byte[] userkey_data = UserKey.getBytes(StandardCharsets.UTF_8);
                sha1.update(userkey_data, 0, userkey_data.length);
                _Key = new SecretKeySpec(sha1.digest(), "Blowfish");
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

        private static void initChiperEncrypt() {
            try {
                // Must use NoPadding
                _Encryptor = Cipher.getInstance("Blowfish/ECB/NoPadding");
                _Encryptor.init(Cipher.ENCRYPT_MODE, _Key);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

        private static void initChiperDecrypt() {
            try {
                // Must use NoPadding
                _Decryptor = Cipher.getInstance("Blowfish/ECB/NoPadding");
                _Decryptor.init(Cipher.DECRYPT_MODE, _Key);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

        private static void initIV() {
            try {
                byte[] initVec = DatatypeConverter.parseHexBinary("FFFFFFFFFFFFFFFF");
                _IV = _Encryptor.doFinal(initVec);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

        private void xorBytes(byte[] a, byte[] b) {
            for (int i = 0; i < a.length; i++) {
                int aVal = a[i] & 0xff; // convert byte to integer
                int bVal = b[i] & 0xff;
                a[i] = (byte) (aVal ^ bVal); // xor aVal and bVal and typecast to byte
            }
        }

        private void xorBytes(byte[] a, byte[] b, int l) {
            for (int i = 0; i < l; i++) {
                int aVal = a[i] & 0xff; // convert byte to integer
                int bVal = b[i] & 0xff;
                a[i] = (byte) (aVal ^ bVal); // xor aVal and bVal and typecast to byte
            }
        }

        static {
            initKey(DefaultUserKey);
            initChiperEncrypt();
            initChiperDecrypt();
            initIV();
        }

        private byte[] Encrypt(byte[] inData) {
            try {
                byte[] CV = Arrays.copyOf(_IV, _IV.length);
                byte[] ret = new byte[inData.length];

                int blocks_len = inData.length / 8;
                int left_len = inData.length % 8;

                for (int i = 0; i < blocks_len; i++) {
                    byte[] temp = Arrays.copyOfRange(inData, i * 8, (i * 8) + 8);

                    xorBytes(temp, CV);
                    temp = _Encryptor.doFinal(temp);
                    xorBytes(CV, temp);

                    System.arraycopy(temp, 0, ret, i * 8, 8);
                }

                if (left_len != 0) {
                    CV = _Encryptor.doFinal(CV);
                    byte[] temp = Arrays.copyOfRange(inData, blocks_len * 8, (blocks_len * 8) + left_len);
                    xorBytes(temp, CV, left_len);
                    System.arraycopy(temp, 0, ret, blocks_len * 8, temp.length);
                }

                return ret;
            } catch (Exception e) {
                e.printStackTrace();
                return null;
            }
        }

        public String encryptString(String inputString) {
            try {
                byte[] inData = inputString.getBytes(StandardCharsets.UTF_8);
                byte[] outData = Encrypt(inData);
                return DatatypeConverter.printHexBinary(outData);
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }

        private byte[] Decrypt(byte[] inData) {
            try {
                byte[] CV = Arrays.copyOf(_IV, _IV.length);
                byte[] ret = new byte[inData.length];

                int blocks_len = inData.length / 8;
                int left_len = inData.length % 8;

                for (int i = 0; i < blocks_len; i++) {
                    byte[] temp = Arrays.copyOfRange(inData, i * 8, (i * 8) + 8);

                    temp = _Decryptor.doFinal(temp);
                    xorBytes(temp, CV);
                    System.arraycopy(temp, 0, ret, i * 8, 8);
                    for (int j = 0; j < CV.length; j++) {
                        CV[j] = (byte) (CV[j] ^ inData[i * 8 + j]);
                    }
                }

                if (left_len != 0) {
                    CV = _Encryptor.doFinal(CV);
                    byte[] temp = Arrays.copyOfRange(inData, blocks_len * 8, (blocks_len * 8) + left_len);

                    xorBytes(temp, CV, left_len);
                    for (int j = 0; j < temp.length; j++) {
                        ret[blocks_len * 8 + j] = temp[j];
                    }
                }

                return ret;
            } catch (Exception e) {
                e.printStackTrace();
                return null;
            }
        }

        public String decryptString(String hexString) {
            try {
                byte[] inData = DatatypeConverter.parseHexBinary(hexString);
                byte[] outData = Decrypt(inData);
                return new String(outData, StandardCharsets.UTF_8);
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }
    }
    static class Navicat12Cipher {
        private static SecretKeySpec _AesKey;
        private static IvParameterSpec _AesIV;

        static {
            _AesKey = new SecretKeySpec("libcckeylibcckey".getBytes(StandardCharsets.UTF_8), "AES");
            _AesIV = new IvParameterSpec("libcciv libcciv ".getBytes(StandardCharsets.UTF_8));
        }

        public String encryptString(String plaintext) {
            try {
                Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
                cipher.init(Cipher.ENCRYPT_MODE, _AesKey, _AesIV);
                byte[] ret = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));
                return DatatypeConverter.printHexBinary(ret);
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }

        public String decryptString(String ciphertext) {
            try {
                Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
                cipher.init(Cipher.DECRYPT_MODE, _AesKey, _AesIV);
                byte[] ret = cipher.doFinal(DatatypeConverter.parseHexBinary(ciphertext));
                return new String(ret, StandardCharsets.UTF_8);
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }
    }
}

 本文仅仅简单介绍了此工具的使用，此项目源代码已开源，欢迎大家下载体验，如果有帮到您，麻烦点下star，谢谢！
项目源码：
github : https://github.com/Zhuoyuan1/navicat_password_decrypt
如果github打不开，码云地址：https://gitee.com/lzy549876/navicat_password_decrypt
  另外网上大多数流传的都是PHP语言版本的，希望能帮助到大家！
  声明：该工具源码仅仅只作学术性研究，不可商业用途！
参考：https://blog.csdn.net/kkk123445/article/details/122514124