DECRIPTING WEBLOGIC PASSWORD

One of the most important WebLogic Server files in terms of security is SerializedSystemIni.dat which contains encrypted security data and is located in$DOMAIN_HOME/security directory. Other file is boot.properties file located in$DOMAIN_HOME/servers/AdminServer/security directory which contains an encrypted version of weblogic admin username and password.

Below tutorial shows how to decrypt, recover username or password, having access to SerializedSystemIni.dat and boot.properties files. But not only, we can also use this method to:

·         recover database username and password of JDBC Connection pool – encrypted password resides in $DOMAIN_HOME/config/jdbc directory, in xml files

·         recover password of a keystore where we store SSL certificates

·         any encrypted password from config.xml  located in $DOMAIN_HOME/config dir

Let’s roll:

NOTE: SerializedSystemIni.dat file exists in $DOMAIN_HOME/security directory.

1. Create a script decrypt_password.py in $DOMAIN_HOME/security directory and paste the following code into it:

from weblogic.security.internal import *

from weblogic.security.internal.encryption import *

encryptionService = SerializedSystemIni.getEncryptionService(".")

clearOrEncryptService = ClearOrEncryptedService(encryptionService)

# Take encrypt password from user

pwd = raw_input("Paste encrypted password ({AES}fk9EK...): ")

# Delete unnecessary escape characters

preppwd = pwd.replace("\\", "")

# Display password

print "Decrypted string is: " + clearOrEncryptService.decrypt(preppwd)

2. Set domain environment variables

source $DOMAIN_HOME/bin/setDomainEnv.sh

3. Get encrypted password, in this example from boot.properties file of AdminServer

#Username:

grep username $DOMAIN_HOME/servers/AdminServer/security/boot.properties | sed -e "s/^username=\(.*\)/\1/"

#Password:

grep password $DOMAIN_HOME/servers/AdminServer/security/boot.properties | sed -e "s/^password=\(.*\)/\1/"

4. Navigate to $DOMAIN_HOME/security directory and run the following command to start decryption:

cd $DOMAIN_HOME/security

java weblogic.WLST decrypt_password.py

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Please enter encrypted password (Eg. {AES}fk9EK...): {AES}jkIkkdh693dsyLt+DrKUfNcXryuHKLJD76*SXnPqnl5oo\=

Decrypted string is: welcome01

Decrypted value will be displayed on the screen.

login as: root

root@172.21.2.5's password:

Last login: Thu Jul 21 18:04:23 2016 from 172.21.21.23

[root@icdemo2 ~]# su - applmgr

[applmgr@icdemo2 ~]$ cd /u01/appsTier/

[applmgr@icdemo2 appsTier]$ ls

EBSapps.env  fs1  fs2  fs_ne

[applmgr@icdemo2 appsTier]$ cd fs1/FMW_Home/user_projects/

applications/ domains/

[applmgr@icdemo2 appsTier]$ cd fs1/FMW_Home/user_projects/

applications/ domains/

[applmgr@icdemo2 appsTier]$ cd fs1/FMW_Home/user_projects/domains/EBS_domain_dem                                                                                        o2/security/

[applmgr@icdemo2 security]$ ls

DefaultAuthenticatorInit.ldift  SerializedSystemIni.dat

DefaultRoleMapperInit.ldift     XACMLRoleMapperInit.ldift

[applmgr@icdemo2 security]$ vi decrypt_password.py

[applmgr@icdemo2 security]$ cd ..

[applmgr@icdemo2 EBS_domain_demo2]$ cd bin/

[applmgr@icdemo2 bin]$ ls

nodemanager        service_migration        startWebLogic.sh

secureWebLogic.sh  setDomainEnv.sh          stopManagedWebLogic.sh

server_migration   startManagedWebLogic.sh  stopWebLogic.sh

[applmgr@icdemo2 bin]$ . setDomainEnv.sh

[applmgr@icdemo2 EBS_domain_demo2]$ cd ..

[applmgr@icdemo2 domains]$ cd EBS_domain_demo2/

[applmgr@icdemo2 EBS_domain_demo2]$ cd servers/AdminServer/security/

[applmgr@icdemo2 security]$ grep password boot.properties | sed -e "s/^password=                                                                                        \(.*\)/\1/"

{AES}5KPQJ/TQknT1qgY5WSAIDNt3pkS2+loekLNPzquk28Q=

[applmgr@icdemo2 security]$ cd /u01/appsTier/fs1/FMW_Home/user_projects/domains/                                                                                        EBS_domain_demo2/security/

[applmgr@icdemo2 security]$ java weblogic.WLST decrypt_password.py

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Paste encrypted password ({AES}fk9EK...):

Decrypted string is:

[applmgr@icdemo2 security]$ java weblogic.WLST decrypt_password.py

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Paste encrypted password ({AES}fk9EK...): {AES}5KPQJ/TQknT1qgY5WSAIDNt3pkS2+loek                                                                                        LNPzquk28Q

Problem invoking WLST - Traceback (innermost last):

 File "/u01/appsTier/fs1/FMW_Home/user_projects/domains/EBS_domain_demo2/securi                                                                                        ty/decrypt_password.py", line 10, in ?

       at weblogic.security.internal.encryption.JSafeEncryptionServiceImpl.decr                                                                                        yptBytes(JSafeEncryptionServiceImpl.java:139)

       at weblogic.security.internal.encryption.JSafeEncryptionServiceImpl.decr                                                                                        yptString(JSafeEncryptionServiceImpl.java:187)

       at weblogic.security.internal.encryption.ClearOrEncryptedService.decrypt                                                                                        (ClearOrEncryptedService.java:96)

       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.                                                                                        java:57)

       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces                                                                                        sorImpl.java:43)

       at java.lang.reflect.Method.invoke(Method.java:606)

weblogic.security.internal.encryption.EncryptionServiceException: weblogic.secur                                                                                        ity.internal.encryption.EncryptionServiceException

[applmgr@icdemo2 security]$ java weblogic.WLST decrypt_password.py

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Paste encrypted password ({AES}fk9EK...): {AES}5KPQJ/TQknT1qgY5WSAIDNt3pkS2+loekLNPzquk28Q=

Decrypted string is: Inbox123

[applmgr@icdemo2 security]$