GLogger.warn('Authentication Failed - ' + localException.getMessage()) bug('Username: : had been authenticated', paramString1) LocalINSFUser = localINSFUser.retrieveFromCache(paramString1) LocalINSFUser = localNSFAdminServiceFactory.getNSFUser() NSFAdminServiceFactory localNSFAdminServiceFactory = NSFAdminServiceFactory.getInstance() Throw new NSFAuthenticationFailed('Password is mandatory') // OK paramString2 is the password Throw new NSFAuthenticationFailed('User name is mandatory') // OK paramString1 is the username ace('Inside method UserIdentityManagement::authenticateUsernamePassword') Public void authenticateUsernamePassword(String paramString1, String paramString2) When a user tries to log in, a POST request is performed on /portal/LoginSubmit.action, and after a lot of JARs, we finally arrive in the UserIdentityManagement class (in nsf-1.4.0-253.jar): package .impl So, we extracted some JARs to find how these passwords were encrypted. We tried regular encryption algorithms (AES, DES, etc.) with various modes but still, nothing worked. LAST_PASSWORD_RESET_TIME TIMESTAMP(6) WITH TIME ZONEĬREATION_TIME TIMESTAMP(6) WITH TIME ZONE

LAST_LOGIN_TIME TIMESTAMP(6) WITH TIME ZONEįIRST_LOGIN_TIME TIMESTAMP(6) WITH TIME ZONE LAST_AUP_ACCEPT_TIME TIMESTAMP(6) WITH TIME ZONE Note: this information is actually stored in the table CEPM.EDF_GUEST_USER of the Oracle database: SQL> describe CEPM.EDF_GUEST_USER ĮDF_PORTAL_USER_GUID NOT NULL VARCHAR2(100)ĮDF_CREATE_TIME TIMESTAMP(6) WITH TIME ZONEĮDF_UPDATE_TIME TIMESTAMP(6) WITH TIME ZONE 'passwordEncryptionKey': 'hJH/AIwyD/UKzxryu1mLvw=',Īlright, it seemed pretty straightforward as we had a password and a passwordEncryptionKey.

Using the rdb tool, it is very easy to convert this database to a JSON file: $ rdb -command json profiler_local.rdb | python -m json.tool We looked for interesting files that may contain credentials and, eventually, stumbled on /opt/CSCOcpm/redis/profiler_local.rdb, which is a Redis database. How it all started Exploring the filesystemĪfter exploiting CVE-2017-5638 during an assessment (yes, in 2019.), we gained access to the internal network of our customer, but then what?

Decrypt cisco secret 4