Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have hosting service hosted on more than 20+ Plesk servers, version 11. As in the previous versions, the passwords were not encrypted, then if i had to design some tools to manage the hosting accounts, i just picked up the cleartext passwords from the Database. but as now the passwords are encrypted, is there any way i can decrypt the passwords? through API or any other way so that i can integrate my php based hosting management with plesk 11?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

The code provided by Giulio isn't helpful, here's a Python script that actually works. Requires PyCrypto (python-crypto). Assumes that Plesk secret key is stored at /etc/psa/private/secret_key. Just run it and pass in encrypted passwords as arguments:

./deplesk.py '$AES-128-CBC$T82uDt6NSdytfhjQaOIKGg==$CMJ6FIdAD8zJ0PgwQ3DosA=='

Script:

#!/usr/bin/env python
import sys
import base64
from Crypto.Cipher import AES

key = open('/etc/psa/private/secret_key', 'rb').read()

for pw in sys.argv[1:]:
    lead, typ, iv, ct = pw.split('$')
    iv = base64.b64decode(iv)
    ct = base64.b64decode(ct)
    assert typ == 'AES-128-CBC'
    plain = AES.new(key, mode=AES.MODE_CBC, IV=iv).decrypt(ct).rstrip(b'\0')
    print(plain.decode('utf8'))
share|improve this answer
    
I can confirm this works with Plesk 11.5 –  Jon Nov 4 '13 at 15:20

Why not just figure out what hashing algorithm Plesk uses, and replicate that functionality in your PHP application? You don't need the un-ecrypted version of a password to authenticated against it, and you never really want to store a password in the clear, or with a reversible encryption.

share|improve this answer
2  
Agreed. It is a BAD idea to store passwords in plaintext. –  David W Sep 6 '12 at 22:35
    
Thirded, you should be working with hashes of the passwords rather than trying to decrypt passwords and hack something together. Going the original route introduces a ton of unnecessary risk. –  bobmagoo Sep 7 '12 at 13:49

Theoretically, if the program can get the encryption password, yes, you can get back the password in plain text.
EDIT: added decryption code.

function decrypt_password($pass,$key)
{

$base64encoded_ciphertext = $pass;

$res_non = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($base64encoded_ciphertext), ‘ecb’);

$decrypted = $res_non;
$dec_s2 = strlen($decrypted);

$padding = ord($decrypted[$dec_s2-1]);
$decrypted = substr($decrypted, 0, -$padding);

return  $decrypted;
}
share|improve this answer
    
Password are encrypted with AES-128-CBC cypher . so possible to get password from them? –  Farhan Sep 7 '12 at 9:40
    
Please review my answer, I've posted the code. –  Giulio Muscarello Sep 7 '12 at 13:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.