Closed n00py closed 1 year ago
Aye, thanks for figuring that out! I was wondering why it didn't work anymore during a recent engagement, but never got around to actually look into why.
I'll update the README with your info.
Yeah. I spendt the last few days trying to figure it out (to no success). It seems that the secrets are still in the same places, but the algorithm has changed somehow, and the password.exe binary is obfuscated.
I'll leave this issue open for now until someone manages to reverse engineer the new algorithm or I find the time to dive into it.
Here's an easy way to do it, credit to unknown cyber criminals:
Looks like they load the PasswordState .NET assembly already on disk and scoop out the AES_Decrypt method.
I've been able to do it that way using the 8.9.9.5 executable, but after version 9, everything is obfuscated and you can't do that anymore. I haven't been able to de-obfuscate it, or find where the code is. Dnspy/ilSpy just show the methods returning null.
Hi all! We were able to make this tool work again, the encryption key is actually the same as before but will be reversed before usage now. We published it in an advisory about some other issues we encountered with Passwordstate: https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
I can confirm Parzel's comment. Just made the changes locally and whala. To think all they did was reverse the stupid encryption key v_v;
Great work @parzel! Feel free to submit a PR if you want to include this in the script. If not, I'll see when I have some time to incorporate it. In the meantime I will add a note to the README for newer versions.
Thanks @RobertDiep. I have created a PR, would be great if someone could verify it is working correctly as I do not have access to an installed instance right now. Feel free to change it if you think there is an easier way to integrate the change.
resolved in 9a0dfbf39873e20156dfb5c60db6ecfce52e53a5 with many thanks to the people at modzero (and specifically @parzel)!
Looks like they modified the crypto. Not a bug with your tool, just an FYI for anyone else trying to use it.