{"id":153,"date":"2013-09-11T02:44:30","date_gmt":"2013-09-11T02:44:30","guid":{"rendered":"http:\/\/www.hackwhackandsmack.com\/?p=153"},"modified":"2013-10-05T10:47:17","modified_gmt":"2013-10-05T10:47:17","slug":"mcafee-epo-static-encryption-key","status":"publish","type":"post","link":"https:\/\/www.hackwhackandsmack.com\/?p=153","title":{"rendered":"Mcafee EPO Static Encryption Key"},"content":{"rendered":"<p><span style=\"font-family: arial, sans-serif;\"><span style=\"font-size: small;\">I came across a Mcafee EPO server not long ago and found that during an on host review it stores the SQL database connection details and encrypted password in a file within the EPO directory, \u201c<span style=\"color: #000000;\">\/conf\/orion\/db.properties\u201d. The password is encrypted with a statically known key that is used on all EPO deployments of a similar version.<\/span><\/span><\/span><\/p>\n<p><span style=\"font-family: arial, sans-serif;\"><span style=\"font-size: small;\"><span style=\"color: #000000;\">The good news is there is already a metasploit module created in which someone has kindly went to the effort to extract the encryption key.<\/span><\/span><\/span><\/p>\n<p><span style=\"font-family: arial, sans-serif;\"><span style=\"font-size: small;\"><span style=\"color: #000000;\">The problem that I encountered was that for me it was not fit for purpose, I needed to decrypt the credentials in the file but the module is a post module and required a session to extract the file. It was not possible to gain a session due to the nature of the test and therefore I rewrote the module into an auxiliary module that takes the file from the local file system and then runs it through the same decryption mechanism.<\/span><\/span><\/span><\/p>\n<p><span style=\"font-family: arial, sans-serif;\"><span style=\"font-size: small;\"><span style=\"color: #000000;\">I hope the following code is of use to someone else who may find themselves in a similar scenario : \u00a0<a href=\"http:\/\/www.hackwhackandsmack.com\/wp-content\/uploads\/2013\/09\/epo-doug.txt\">epo-doug<\/a><\/span><\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I came across a Mcafee EPO server not long ago and found that during an on host review it stores the SQL database connection details and encrypted password in a file within the EPO directory, \u201c\/conf\/orion\/db.properties\u201d. The password is encrypted with a statically known key that is used on all EPO deployments of a similar version.<\/p>\n<p>The good news is there is already a metasploit module created in which someone has kindly went to the effort to extract the encryption key.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/posts\/153"}],"collection":[{"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=153"}],"version-history":[{"count":5,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/posts\/153\/revisions"}],"predecessor-version":[{"id":157,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=\/wp\/v2\/posts\/153\/revisions\/157"}],"wp:attachment":[{"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hackwhackandsmack.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}