import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.Random;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;

public class FinalShellDecodePass {
    public static void main(String[] args) throws Exception {
        // 示例：解密加密后的密码字符串
        System.out.println(decodePass("aT4+S0skaRPWjdVrDwHtdHSlTMRIR3mWAzLRyHsR4p0="));
    }

    public static String decodePass(String data) throws Exception {
        if (data == null) {
            return null;
        }
        byte[] buf = Base64.getDecoder().decode(data);
        // 前 8 字节为 head
        byte[] head = new byte[8];
        System.arraycopy(buf, 0, head, 0, head.length);
        // 剩余部分为密文
        byte[] d = new byte[buf.length - head.length];
        System.arraycopy(buf, head.length, d, 0, d.length);
        // DES 解密
        byte[] bt = desDecode(d, ranDomKey(head));
        return new String(bt);
    }

    public static byte[] desDecode(byte[] data, byte[] head) throws Exception {
        SecureRandom sr = new SecureRandom();
        DESKeySpec dks = new DESKeySpec(head);
        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");
        SecretKey securekey = keyFactory.generateSecret(dks);
        Cipher cipher = Cipher.getInstance("DES");
        cipher.init(Cipher.DECRYPT_MODE, securekey, sr);
        return cipher.doFinal(data);
    }

    static byte[] ranDomKey(byte[] head) {
        // 固定种子 + head[5] 参与计算
        long ks = 3680984568597093857L / (long) (new Random((long) head[5]).nextInt(127));
        Random random = new Random(ks);
        int t = head[0];
        for (int i = 0; i < t; i++) {
            random.nextLong();
        }
        long n = random.nextLong();
        Random r2 = new Random(n);
        long[] ld = new long[] {
            (long) head[4], r2.nextLong(), (long) head[7],
            (long) head[3], r2.nextLong(), (long) head[1],
            random.nextLong(), (long) head[2]
        };
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        DataOutputStream dos = new DataOutputStream(bos);
        for (long l : ld) {
            dos.writeLong(l);
        }
        dos.close();
        byte[] keyData = bos.toByteArray();
        // MD5 哈希后作为 DES 密钥
        return md5(keyData);
    }

    public static byte[] md5(byte[] data) {
        try {
            MessageDigest m = MessageDigest.getInstance("MD5");
            m.update(data, 0, data.length);
            return m.digest();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            return null;
        }
    }
}