Oracle toplink mapping workbench password algorithm

[Pete Finnigan]

Hi

I thought readers here might be interested in this item. Today I found
that a website has posted the algorithm and sample code for the
encryption algorithm used in Oracles toplink mapping workbench. This
code can be used to decrypt the passwords held in the xml file easily. A
link to the details can be found on my website at
http://www.petefinnigan.com/orasec.htm

If you use this tool beware of this fact and protect the files used.

kind regards

Pete
--
Pete Finnigan
emailete@petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Bookracle security step-by-step Guide - see http://store.sans.org for details.

[Martin]

--------------080509040200000805020907
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Read the link, really interesting. There's a tiny mistake there tho, on
the example. 97 + 112 does not equal 224, no matter what. I was coding a
PERL script to decrypt the passwords, and I took the 'pa' '74E0'
example, since I was a bit lazy to code a "crypter". Well, here's a PERL
script that will decode the password, email me if you can improve it, or
if you find any errors (Im pretty sure it has, it's pretty ugly).


--------------080509040200000805020907
Content-Type: application/x-perl;
name="oracletest.pl"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="oracletest.pl"

#!/usr/bin/perl
#Decrypt Oracle Toplink Mapping WorkBench passwords.
#Author: Martin

$string = "A7FCAA504BA7E4FC";

sub usage {
print " Usage: $0 <password to decrypt>\n";
}

if ($#ARGV != 0) {
usage();
}

else {
$encrypted = $ARGV[0];
$encrypted =~ s/$string/ /;
$chars = length($encrypted);
$enc2 = substr($encrypted,0,2);
$encrypted = substr($encrypted,2,length($encrypted));
$i = 0;
while (($chars / 2) >= $i + 1) {
print $i;
$int = hex($enc2);
if (($i%2) == 1) { $result .= chr($int - ( ($i + 1 )/3 ) - 112); }
else { $result .= chr($int - 4 + $i); }
$enc2 = substr($encrypted,0,length($encrypted) - 1);
$encrypted = substr($encrypted,2,length($encrypted));
$i++;
}
print "$result\n";
}



--------------080509040200000805020907--

[Pete Finnigan]

Hi Everyone,

Martin (broadcast@mail.ptraced.net) has written a perl script to decrypt
the passwords and has kindly allowed me to host his script on my Oracle
security tools page so if anyone would like to bookmark it for future
reference its on http://www.petefinnigan.com/tools.htm or directly a
link to the file is http://www.petefinnigan.com/oracletest.perl

Kind regards

Pete


In article <LREiMlBezvFARxra@peterfinnigan.demon.co.uk>, Pete Finnigan
<plsql@petefinnigan.com> writes
>Hi
>
>I thought readers here might be interested in this item. Today I found
>that a website has posted the algorithm and sample code for the
>encryption algorithm used in Oracles toplink mapping workbench. This
>code can be used to decrypt the passwords held in the xml file easily. A
>link to the details can be found on my website at
>http://www.petefinnigan.com/orasec.htm
>
>If you use this tool beware of this fact and protect the files used.
>
>kind regards
>
>Pete

--
Pete Finnigan
emailete@petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Bookracle security step-by-step Guide - see http://store.sans.org for details.