Recovering WebLogic Passwords

In one of my previous articles (here) I explained that the SerializedSystemIni.dat file in WebLogic contains the key used to encrypt and decrypt passwords. If you're not currently keeping this file secure I suggest you do, as with it someone can (to name a few things):

• Decrypt the WebLogic admin username and password from boot.properties.
• Recover database passwords, if JDBC Connection pools are configured, from config.xml.
• Recover the keystore passwords from config.xml and obtain SSL certificates stored in the jks keystores.

Essentially, they can do whatever they want, so if you don't know who can read your SerializedSystemIni.dat files, look... now.

In this article I will show how easy it is for this file to be used to recover lost passwords via a simple WLST script.

The Script

The script I use to decrypt passwords is incredibly short, and it works with WebLogic 8, 9 and 10 (probably for version 7 too). To use it, just create a new file called decryptpwd.py and paste the following code into it:

from weblogic.security.internal import *

from weblogic.security.internal.encryption import *

# Remind user about how to use

raw_input("Please ensure SerializedSystemIni.dat is in the current directory now, and press ENTER to continue.")

# Get encryption service

encryptionService = SerializedSystemIni.getEncryptionService(".")

clearOrEncryptService = ClearOrEncryptedService(encryptionService)

# Get user to enter password

pwd = raw_input("Enter encrypted password (Eg. {3DES}Y1fA34S...): ")

# Remove unnecessary escape characters

preppwd = pwd.replace("\\", "")

# Decrypt the password

print "Recovered password is: " + clearOrEncryptService.decrypt(preppwd)

You can download the script (decryptpwd.py) here.

Running the Script

To run this script, execute the WLST environment and provide it with the script to run. If you're using a version of WebLogic older than 8.1.6 you'll need to install a newer version which has WLST.

Use the following command (replace %WL_HOME% with the correct directory) to run the script.

%WL_HOME%\common\bin\wlst.cmd decryptpwd.py

Once the WLST environment has started up, the script will remind you to copy the SerializedSystemIni.dat file into the current directory. Press enter and paste your encrypted password string. That's it. It will spit out the password in plain-text.

Understanding the Script

The script is so short and simple it is barely worth explaining, but here are a few things worth mentioning.

You'll notice that the first two lines import weblogic.security packages. These are largely undocumented, so don't expect to find much information on them.

The next significant piece of code instantiates a ClearOrEncryptedService object which will use the SerializedSystemIni.dat file located in the current directory (".").

The final line of code decrypts the password and prints it in plain text.