Plesk uses symmetrical encryption for many passwords in its internal MySQL database “psa”. There are several decryption scripts exist, but none for Plesk on Windows so far. This blog post is to finally change it.
You can find symmetrically encrypted passwords in these tables in Plesk’s “psa” database:
- accounts (collumn
password) - databaseservers (collumn
admin_password) - dsn (collumn
cstring) - longtaskparams (a record called
oldBackupkey– a parameter forbackup-encrypt-task(see thelongtaskstable)) - misc (collumn
aps_password) - servicenodeconfiguration (collumn
valuefor the section MailGate / password) - smb_users (collumn
password)
Symmetrically encrypted passwords look like this: “$AES-128-CBC$ABNK35ZcqnbTYT4Q3mbaEA$HmGDWmtym6K3+kJ8uBoJOg”:
They start with “$AES-128-CBC$”. Then between the second and the third dollar signs there is an AES initialization vector. After that, until the end of the string, we have the encrypted data itself.
In Linux the symmetric key, which Plesk uses to encrypt all these passwords, is located in /etc/psa/private/secret_key. In Windows they put it in registry: HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key\sym_key
To retrieve an encrypted password, use your favorite MySQL tool to connect to the database and copy it from there.
Copy a password you want to decrypt and pass in to the -EncryptedString parameter of the script below. Mind, that you must run the script on the same server where you have that instance of Plesk installed, otherwise it won’t be able to extract the symmetric key. If you want to decrypt passwords on a different machine, you need to pass the symmetric key manually to the script’s -SymmetricKey parameter.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
<# .SYNOPSIS Decrypts passwords symmetrically encrypted by Plesk on Windows. .DESCRIPTION Plesk uses symmetrical encryption for many passwords in its internal MySQL database "psa". With the help of this script you can now decrypt them for Plesk running on Windows as well. .PARAMETER EncryptedString An encrypted string you found Plesk's psa database .PARAMETER SymmetricKey Plesk symmetric encryption key. You can find it at HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key\sym_key, but this script extracts it automatically. .EXAMPLE ConvertFrom-PleskSymmetricallyEncryptedString.ps1 -EncryptedString '$AES-128-CBC$ABNK35ZcqnbTYT4Q3mbaEA$HmGDWmtym6K3+kJ8uBoJOg' .OUTPUTS [string] .NOTES Author: Kirill Nikolaev Twitter: @exchange12rocks Web-site: https://exchange12rocks.org GitHub: https://github.com/exchange12rocks .LINK https://exchange12rocks.org/2021/02/08/how-to-decrypt-plesk-passwords-on-windows/ .LINK https://github.com/exchange12rocks/PS/blob/master/ConvertFrom-PleskSymmetricallyEncryptedString.ps1 .LINK https://mor-pah.net/2014/03/05/decrypt-plesk-11-passwords/ .LINK https://codeforcontent.com/blog/using-aes-in-powershell/ #> #Requires -Version 3.0 Param ( [Parameter(Mandatory)] [string]$EncryptedString, [byte[]]$SymmetricKey = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key' -Name sym_key).sym_key ) $EncryptedStringSplitted = $EncryptedString.Split('$') $IV = $EncryptedStringSplitted[2] $Data = $EncryptedStringSplitted[3] $IVRemainder = $IV.Length % 4 if ($IVRemainder) { $IV = $IV.PadRight($IV.Length + $IVRemainder, '=') } $DataRemainder = $Data.Length % 4 if ($DataRemainder) { $Data = $Data.PadRight($Data.Length + $DataRemainder, '=') } $AESCipher = New-Object -TypeName 'System.Security.Cryptography.AesCryptoServiceProvider' $AESCipher.Key = $SymmetricKey $EncryptedBytes = [System.Convert]::FromBase64String($Data) $AESCipher.IV = [System.Convert]::FromBase64String($IV) $Decryptor = $AESCipher.CreateDecryptor() $UnencryptedBytes = $Decryptor.TransformFinalBlock($EncryptedBytes, 0, $EncryptedBytes.Length) [System.Text.Encoding]::UTF8.GetString($UnencryptedBytes) |
See also:
https://gist.github.com/gnanet/99f5e284c0f71032498625368ba67659
https://www.besuchet.net/2016/06/plesk-11-encrypted-hashed-password-authentication-php-on-psa-database/
https://mor-pah.net/2014/03/05/decrypt-plesk-11-passwords/
https://codeforcontent.com/blog/using-aes-in-powershell/