I have hosting service hosted on more than 20+ Plesk servers, version 11. As in the previous versions, the passwords were not encrypted, then if i had to design some tools to manage the hosting accounts, i just picked up the cleartext passwords from the Database. but as now the passwords are encrypted, is there any way i can decrypt the passwords? through API or any other way so that i can integrate my php based hosting management with plesk 11?


The code provided by Giulio isn't helpful, here's a Python script that actually works. Requires PyCrypto (python-crypto). Assumes that Plesk secret key is stored at /etc/psa/private/secret_key. Just run it and pass in encrypted passwords as arguments:

./deplesk.py '$AES-128-CBC$T82uDt6NSdytfhjQaOIKGg==$CMJ6FIdAD8zJ0PgwQ3DosA=='


#!/usr/bin/env python
import sys
import base64
from Crypto.Cipher import AES

key = open('/etc/psa/private/secret_key', 'rb').read()

for pw in sys.argv[1:]:
    lead, typ, iv, ct = pw.split('$')
    iv = base64.b64decode(iv)
    ct = base64.b64decode(ct)
    assert typ == 'AES-128-CBC'
    plain = AES.new(key, mode=AES.MODE_CBC, IV=iv).decrypt(ct).rstrip(b'\0')
  • I can confirm this works with Plesk 11.5 – Jon Nov 4 '13 at 15:20
  • Don't forget single quotes around passsword otherwise you'll get a "ValueError: need more than 2 values to unpack" – Marco Marsala Sep 7 '15 at 10:27
  • Not always working btw... with this password $AES-128-CBC$05M0XNpwbg6UzMV7nSj2qw==$d6vcsC92Ly2dlGhXS0372w== or this password $AES-128-CBC$KEKiihkO0Kjm+Nc+3BthBQ==$R8MJan9e1KLzTL6+FsCUxg== you'll get a ValueError: need more than 1 values to unpack" – Marco Marsala Sep 7 '15 at 10:50
  • the code above does not appear to work. – Turgut Kalfaoglu Sep 11 '15 at 15:31

Why not just figure out what hashing algorithm Plesk uses, and replicate that functionality in your PHP application? You don't need the un-ecrypted version of a password to authenticated against it, and you never really want to store a password in the clear, or with a reversible encryption.

  • 5
    Agreed. It is a BAD idea to store passwords in plaintext. – David W Sep 6 '12 at 22:35
  • Thirded, you should be working with hashes of the passwords rather than trying to decrypt passwords and hack something together. Going the original route introduces a ton of unnecessary risk. – bobmagoo Sep 7 '12 at 13:49

Theoretically, if the program can get the encryption password, yes, you can get back the password in plain text.
EDIT: added decryption code.

function decrypt_password($pass,$key)

$base64encoded_ciphertext = $pass;

$res_non = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($base64encoded_ciphertext), ‘ecb’);

$decrypted = $res_non;
$dec_s2 = strlen($decrypted);

$padding = ord($decrypted[$dec_s2-1]);
$decrypted = substr($decrypted, 0, -$padding);

return  $decrypted;
  • Password are encrypted with AES-128-CBC cypher . so possible to get password from them? – Farhan Sep 7 '12 at 9:40
  • Please review my answer, I've posted the code. – Giulio Muscarello Sep 7 '12 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.