Contents
Why are passwords stored in a reversible way?
Storing encrypted passwords in a way that is reversible means that the encrypted passwords can be decrypted. A knowledgeable attacker who is able to break this encryption can then log on to network resources by using the compromised account.
What do you need to know about reversible encryption?
Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting. The Store password using reversible encryption policy setting provides support for applications that use protocols that require the user’s password for authentication.
Do you need to enable reversible encryption in IIS?
Digest Authentication in Internet Information Services (IIS) also requires that you enable this policy setting. Set the value for Store password using reversible encryption to Disabled. If you use CHAP through remote access or IAS, or Digest Authentication in IIS, you must set this value to Enabled.
What happens to passwords when policy settings are disabled?
When policy settings are disabled, only new passwords will be stored using one-way encryption by default. Existing passwords will be stored using reversible encryption until they are changed.
How can I reverse an obfuscated password in Python?
We use NSA’s decompiler Ghidra and identify the portion of the machine code responsible for deobfuscation: We just need to extract some constants from the program and in some 80 lines of python code, we can reproduce the behaviour of the deobfuscation successfully:
How can I get rid of a password that has been deobfuscated?
After a few steps in the debugger, the deobfuscated password appears: Using the knowledge acquired through our debugging, we know where to look for the decryption code. We use NSA’s decompiler Ghidra and identify the portion of the machine code responsible for deobfuscation: