Skip to main content

Recovering WebLogic Passwords

In one of my previous articles (here) I explained that the SerializedSystemIni.dat file in WebLogic contains the key used to encrypt and decrypt passwords. If you're not currently keeping this file secure I suggest you do, as with it someone can (to name a few things):
  • Decrypt the WebLogic admin username and password from
  • Recover database passwords, if JDBC Connection pools are configured, from config.xml.
  • Recover the keystore passwords from config.xml and obtain SSL certificates stored in the jks keystores.
Essentially, they can do whatever they want, so if you don't know who can read your SerializedSystemIni.dat files, look... now.

In this article I will show how easy it is for this file to be used to recover lost passwords via a simple WLST script.

The Script

The script I use to decrypt passwords is incredibly short, and it works with WebLogic 8, 9 and 10 (probably for version 7 too). To use it, just create a new file called and paste the following code into it:

from import *
from import *

# Remind user about how to use
raw_input("Please ensure SerializedSystemIni.dat is in the current directory now, and press ENTER to continue.")

# Get encryption service
encryptionService = SerializedSystemIni.getEncryptionService(".")
clearOrEncryptService = ClearOrEncryptedService(encryptionService)

# Get user to enter password
pwd = raw_input("Enter encrypted password (Eg. {3DES}Y1fA34S...): ")

# Remove unnecessary escape characters
preppwd = pwd.replace("\\", "")

# Decrypt the password
print "Recovered password is: " + clearOrEncryptService.decrypt(preppwd)

You can download the script ( here.

Running the Script

To run this script, execute the WLST environment and provide it with the script to run. If you're using a version of WebLogic older than 8.1.6 you'll need to install a newer version which has WLST.

Use the following command (replace %WL_HOME% with the correct directory) to run the script.


Once the WLST environment has started up, the script will remind you to copy the SerializedSystemIni.dat file into the current directory. Press enter and paste your encrypted password string. That's it. It will spit out the password in plain-text.

Understanding the Script

The script is so short and simple it is barely worth explaining, but here are a few things worth mentioning.

You'll notice that the first two lines import packages. These are largely undocumented, so don't expect to find much information on them.

The next significant piece of code instantiates a ClearOrEncryptedService object which will use the SerializedSystemIni.dat file located in the current directory (".").

The final line of code decrypts the password and prints it in plain text.


  1. it is nice code to decript the password.

  2. Excellent posting.

  3. It worked.

    It is not specified that where to keep this script file. Let's say your WL installation home is "C:\bea\" then your should keep this script in "C:\bea\user_projects\domains\%YOUR_DOMAIN%\security" folder

    Thanks a lot.

  4. It worked and like last comment mentioned - PY script needs to be in same folder as "SerializedSystemIni.dat" (that is, under '"%WL_HOME%\user_projects\domains\\security') folder

  5. Hi, where can I find the encrypted keystore password for weblogic 9.2?

  6. Thanks a lot Dear..It helped a lot.
    Cheers !!!

  7. Its awsome!!!! its helped a lot. Thanks you very much!

  8. boy...... u r a genius thnks a lot.... i mean it
    i wasted a whole day to find the script. googled it,
    many scripts came but without details where to place the script and from where to run .Finally i found ur site. thanks a lot.

  9. You saved me after the consultant left. Even he didn't remember the password.

  10. You're the best, this article is awesome !


Post a Comment

Popular posts from this blog

BAD_CERTIFICATE - A corrupt or unuseable certificate...

This is a simple symptom-cause-solution blog entry only. I hope these blogs will help fellow administrators.
In wls_utc, when trying to test a webservice using SSL, the following error message is received: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
If SSL debugging is enabled, the following error also appears in the logs: ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)' <1254822672320>>
verification failed because RSA key public exponent [3] is too small
The certificate encryption is of a weaker strength than expected by newer versions of Java.
Add the flag "" to the server startup parameters.


Connection refused: No available router to destination

This is a simple symptom-cause-solution blog entry only. I hope these blogs will help fellow administrators.

The following exception occurs in WebLogic server logs. Most likely to occur during WebLogic server start-up, but similar exceptions may occur at other times. t3://myserver:8000: Destination unreachable; nested exception is: Connection refused: connect; No available router to destination] at weblogic.jndi.internal.ExceptionTranslator.toNamingException( at weblogic.jndi.WLInitialContextFactoryDelegate.toNamingException( at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext( at weblogic.jndi.Environment.getContext( at weblogic.jndi.Environment.getContext(
This message (Connection refused: connect; No available router to destination) is a kind of "catch…

BEASVC.EXE - WebLogic as a Windows Service

I remember the first time I had to work out why WebLogic wouldn't run as a service. It was a frustrating experience. There were no error messages. No Windows error dialog. No console output.

How do you troubleshoot something like this??!!

This short article will show you. For simplicity I'll talk about the node manager, but the same principles apply for running an admin or managed server as a service.

First Steps

First, you still have your server logs. Sure the console output is better, but it's a starting point. Check this log for errors and especially take note of the start up variables such as PATH and CLASSPATH. If the server log isn't being created, that tells you WebLogic probably isn't even being started. (Check that you have a license file if you haven't already.)

Ok, so the logs were no help. The next step is to look at how the service is trying to start WebLogic.

When you install WebLogic as a service, you're really setting up beasvc.exe as the service.…