Reverse engineering and decrypting CyberArk vault credential files

▤ Summary

I immediately suspected I could reverse or break the crypto to recover the password, though the binaries were quite large and complex (C++ classes everywhere). So during a boring COVID stay-at-home holiday I dove into the CreateCredFile.exe binary, used to create new credential files, and started reverse engineering the logic. This string will consist of the following parts, appended together: • The Application Type restriction, converted to lower case, hashed with SHA1 and base64 encoded. The additional verification attributes the software can use to include in the base key can be provided as command line arguments to the decryption tool. We reported this issue at CyberArk and they released a new version mitigating the decryption of the credential file by changing the crypto implementation and making the DPAPI option the default.

▦ Linked Companies

GitHub, Inc.

$1M to $5M