Weblogic解密脚本（无需weblogic环境）

关于解密weblogic AES或DES加密方法，在有weblogic环境下很容易，大家都会。之前有看到无需配置weblogic环境即可解密的文章，Zone里有的小伙伴说编译不通，跑不起来，昨天特意测试了一下，跟大家分享。
解密脚本WebLogicPasswordDecryptor.java
参见https://github.com/NetSPI/WebLogicPasswordDecryptor
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import sun.misc.BASE64Decoder;

import javax.crypto.*;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.Security;
import java.security.spec.InvalidKeySpecException;


public class WebLogicPasswordDecryptor {

    public static void main(String args[]) throws IOException, NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, InvalidKeySpecException, InvalidAlgorithmParameterException {

        Security.addProvider(new BouncyCastleProvider());
        String serializedSystemIniPath = args[0];
        String ciphertext = args[1];
        String cleartext = "";

        if (ciphertext.startsWith("{AES}")){
            ciphertext = ciphertext.replaceAll("^[{AES}]+", "");
            cleartext = decryptAES(serializedSystemIniPath,ciphertext);
        } else if (ciphertext.startsWith("{3DES}")){
            ciphertext = ciphertext.replaceAll("^[{3DES}]+", "");
            cleartext = decrypt3DES(serializedSystemIniPath, ciphertext);
        }

        System.out.println(cleartext);
    }

    public static String decryptAES(String SerializedSystemIni, String ciphertext) throws NoSuchAlgorithmException, InvalidKeySpecException, NoSuchPaddingException, InvalidAlgorithmParameterException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, IOException {

        byte[] encryptedPassword1 = new BASE64Decoder().decodeBuffer(ciphertext);
        byte[] salt = null;
        byte[] encryptionKey = null;

        String key = "0xccb97558940b82637c8bec3c770f86fa3a391a56";

        char password[] = new char[key.length()];

        key.getChars(0, password.length, password, 0);

        FileInputStream is = new FileInputStream(SerializedSystemIni);
        try {
            salt = readBytes(is);

            int version = is.read();
            if (version != -1) {
                encryptionKey = readBytes(is);
                if (version >= 2) {
                    encryptionKey = readBytes(is);
                }
            }
        } catch (IOException e) {

        }

        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWITHSHAAND128BITRC2-CBC");

        PBEKeySpec pbeKeySpec = new PBEKeySpec(password, salt, 5);

        SecretKey secretKey = keyFactory.generateSecret(pbeKeySpec);

        PBEParameterSpec pbeParameterSpec = new PBEParameterSpec(salt, 0);

        Cipher cipher = Cipher.getInstance("PBEWITHSHAAND128BITRC2-CBC");
        cipher.init(Cipher.DECRYPT_MODE, secretKey, pbeParameterSpec);
        SecretKeySpec secretKeySpec = new SecretKeySpec(cipher.doFinal(encryptionKey), "AES");

        byte[] iv = new byte[16];
        System.arraycopy(encryptedPassword1, 0, iv, 0, 16);
        int encryptedPasswordlength = encryptedPassword1.length - 16 ;
        byte[] encryptedPassword2 = new byte[encryptedPasswordlength];
        System.arraycopy(encryptedPassword1, 16, encryptedPassword2, 0, encryptedPasswordlength);
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        Cipher outCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        outCipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivParameterSpec);

        byte[] cleartext = outCipher.doFinal(encryptedPassword2);

        return new String(cleartext, "UTF-8");

    }

    public static String decrypt3DES(String SerializedSystemIni, String ciphertext) throws NoSuchAlgorithmException, InvalidKeySpecException, NoSuchPaddingException, InvalidAlgorithmParameterException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, IOException {

        byte[] encryptedPassword1 = new BASE64Decoder().decodeBuffer(ciphertext);
        byte[] salt = null;
        byte[] encryptionKey = null;

        String PW = "0xccb97558940b82637c8bec3c770f86fa3a391a56";

        char password[] = new char[PW.length()];

        PW.getChars(0, password.length, password, 0);

        FileInputStream is = new FileInputStream(SerializedSystemIni);
        try {
            salt = readBytes(is);

            int version = is.read();
            if (version != -1) {
                encryptionKey = readBytes(is);
                if (version >= 2) {
                    encryptionKey = readBytes(is);
                }
            }


        } catch (IOException e) {

        }

        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWITHSHAAND128BITRC2-CBC");

        PBEKeySpec pbeKeySpec = new PBEKeySpec(password, salt, 5);

        SecretKey secretKey = keyFactory.generateSecret(pbeKeySpec);

        PBEParameterSpec pbeParameterSpec = new PBEParameterSpec(salt, 0);

        Cipher cipher = Cipher.getInstance("PBEWITHSHAAND128BITRC2-CBC");
        cipher.init(Cipher.DECRYPT_MODE, secretKey, pbeParameterSpec);
        SecretKeySpec secretKeySpec = new SecretKeySpec(cipher.doFinal(encryptionKey),"DESEDE");

        byte[] iv = new byte[8];
        System.arraycopy(salt, 0, iv, 0, 4);
        System.arraycopy(salt, 0, iv, 4, 4);

        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        Cipher outCipher = Cipher.getInstance("DESEDE/CBC/PKCS5Padding");
        outCipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivParameterSpec);

        byte[] cleartext = outCipher.doFinal(encryptedPassword1);
        return new String(cleartext, "UTF-8");

    }

    public static byte[] readBytes(InputStream stream) throws IOException {
        int length = stream.read();
        byte[] bytes = new byte[length];
        int in = 0;
        int justread;
        while (in < length) {
            justread = stream.read(bytes, in, length - in);
            if (justread == -1) {
                break;
            }
            in += justread;
        }
        return bytes;
    }
}

直接编译一般会出错。
有两个注意点：
0x01
需要下载一个bcprov-ext-jdk16-146.jar包，拷贝到C:\Program Files\Java\jdk1.7.0_55\jre\lib\ext\

0x02
环境配置：修改C:\Program Files\Java\jdk1.7.0_55\jre\lib\security\java.security文件，增加一行
security.provider.11=org.bouncycastle.jce.provider.BouncyCastleProvider


这里为了形象直观，我用了eclipse编译，当然也可以用cmd命令行直接编译。
OK，编译无错误了。


之后就可以直接用编译好的WebLogicPasswordDecryptor.class来解密了
用法：命令行下
Java WebLogicPasswordDecryptor "SerializedSystemIni.dat文件物理路径" "{AES}或{DES}加密内容"

1. C4ndy (打酱油。。) | 2015-09-10 15:34

   之前用的一个国外的网站可以解密

2. 
   3# Hckmaple (水能载舟，亦可赛艇) | 2015-09-10 20:30

   NICE！！！

3. 
   4# _Thorns (创业公司招聘系统运维、软件逆向、数据可视化攻城狮。) | 2015-09-11 13:49

   楼主 mark！ @C4ndy 求看，

4. 
   5# C4ndy (打酱油。。) | 2015-09-11 15:44

   @_Thorns 记得是这个,不知道是不是我代理的问题，访问不到

5. 
   6# _Thorns (创业公司招聘系统运维、软件逆向、数据可视化攻城狮。) | 2015-09-12 23:18

   @C4ndy 访问不了了，
   Error: Not Found
   
   The requested URL / was not found on this server.

6. 
   7# 兔小白 (www.sougaoqing.com) | 2015-10-07 15:31

   赞楼主。不错~~

7. 
   8# 兔小白 (www.sougaoqing.com) | 2015-10-07 15:31

   @C4ndy 国外的网站能发一下么？

8. 
   9# C4ndy (打酱油。。) | 2015-10-10 22:55

   @兔小白 打不开了貌似

9. 
   10# cf_hb (10000定律<=>实践ing) | 2016-01-20 16:57

   Weblogic的10.3.6 的security.xml 可解密么？

10. 
    11# 进击的zjx | 2016-01-20 18:08

    @cf_hb 没试过，这个里面放了什么？理论上可以，因为用的同一种加密方式和秘钥

11. 
    12# cf_hb (10000定律<=>实践ing) | 2016-01-20 20:04

    @进击的zjx 实际上很多都不可以

12. 
    13# Hckmaple (水能载舟，亦可赛艇) | 2016-01-29 10:11

    大牛，能不能求一份你这个编译后的class

13. 
    14# Hckmaple (水能载舟，亦可赛艇) | 2016-01-29 11:28

    执行的时候出这个错误 怎么解决
    
    Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/jce/
    provider/BouncyCastleProvider

14. 
    15# 进击的zjx | 2016-01-29 14:14

    @Hckmaple 你这个错误就是我帖子里面提的0x02配置啊
    0x02
环境配置：修改C:\Program Files\Java\jdk1.7.0_55\jre\lib\security\java.security文件，增加一行
security.provider.11=org.bouncycastle.jce.provider.BouncyCastleProvider

15. 
    16# Hckmaple (水能载舟，亦可赛艇) | 2016-01-29 14:50

    @进击的zjx 增加了，然而依旧报错

16. 
    17# gery | 2016-02-05 15:07

    安装jdk1.8.0_71，按照要求配置成功解密weblogic8.1.3的密码，编译时出现3个警告，但是不影响使用，很好很强大。他还有一个powershell的怎么也不行，执行第二个命令提示不是函数。这个需要什么环境，请指教。

17. 
    18# theone | 2016-02-10 00:15

    @进击的zjx SerializedSystemIni.dat 这个是啥？weblogic服务器上的吗？

18. 
    19# 进击的zjx | 2016-02-10 21:07

    @theone 服务器目录下的

19. 
    20# んi_Stefen | 2016-02-25 00:00

    0x02的java.security文件，增加了security.provider.11=org.bouncycastle.jce.provider.BouncyCastleProvider
    执行时候总报错
    Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/jce/
    provider/BouncyCastleProvider

20. 
    21# んi_Stefen | 2016-02-25 00:08

    我发现我JDK同目录下还有一个jre目录 里面把0x01和0x02再做一遍就不报这个错误了

21. 
    22# んi_Stefen | 2016-02-25 11:16

    C:\Users\test\Desktop>java WebLogicPasswordDecryptor "C:\Users\test\Desktop\SerializedSystemIni.dat"  {AES}t39RSE5vVAuvKwCDWxdtLukte+4lfenzIUflgr2xNzI\=
    Exception in thread "main" javax.crypto.IllegalBlockSizeException: last block incomplete in decryption
            at org.bouncycastle.jce.provider.JCEBlockCipher.engineDoFinal(Unknown Source)
            at javax.crypto.Cipher.doFinal(Cipher.java:2121)
            at WebLogicPasswordDecryptor.decryptAES(WebLogicPasswordDecryptor.java:76)
            at WebLogicPasswordDecryptor.main(WebLogicPasswordDecryptor.java:30)

22. 
    23# んi_Stefen | 2016-02-25 11:27

    困难重重 求解

23. 
    24# んi_Stefen | 2016-02-26 14:41

    @进击的zjx    请问这样报错是什么原因呢Exception in thread "main" javax.crypto.IllegalBlockSizeException

24. 
    25# water (呼啦啦、嘿嘿嘿) | 2016-03-02 16:23

    出现这种情况，怎么办

25. 
    26# 胡阿尤 | 2016-03-14 01:04

    @water 仔细看楼主的截图。把WebLogicPasswordDecryptor.class后面的.class去掉。

26. 
    27# 胡阿尤 | 2016-03-14 01:08

    @んi_Stefen @进击的zjx 我也遇到同样的问题，求指点。
    

27. 
    28# 金枪银矛小霸王 (勿忘初心:)) | 2016-03-16 00:19

    @进击的zjx 大神怎么回事