############################################################ ############

Trend Micro OfficeScan encrypted MD5 passwords
by Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org

############################################################ ############


Trend Micro OfficeScan encrypts the MD5 hashes of the stored passwords
(master, uninstall and unload) in the file Ofcscan.ini sometimes called
also settings.ini.
That means you will not able to retrieve the original password but ONLY
it's MD5 hash.

The strings you see in this file have a name that finishes ever with the
_Pwd text and have the format !CRYPT!HEX_STRING like the following
examples:

Master_Pwd=!CRYPT!0123456789ABCDEF0123456789ABCDEF0123456789 ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789A
Uninstall_Pwd=!CRYPT!0123456789ABCDEF0123456789ABCDEF0123456 789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789A
Unload_Pwd=!CRYPT!0123456789ABCDEF0123456789ABCDEF0123456789 ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789A

The hash after !CRYPT! is passed to a function which decrypts it using
the keys Virus3761267Trend and Windows7621673NT.

Actually I don't have time to work on an open source version of this
algorithm so an enough quick solution for decrypting these *_Pwd hashes
is using a debugger (like the great Ollydbg http://www.ollydbg.de) and
set a breakpoint at the offset in which starts the decryption (in
Ollydbg when the executable is loaded or the process is attached press
CTRL+G, type the offset and then press F2, when you reach the function
press F8 for advancing step-by-step).

The following are the decryption and ecryption offsets of some versions
of PccNTMon.exe:

5.5.0.2021
decrypt: 00419d4e
encrypt: 00419ca3

5.58.0.1063
decrypt: 004193ae
encrypt: 00419303

5.58.0.1164
decrypt: 0041a2ae
encrypt: 0041a203

6.5.0.1402
decrypt: 0041594e
encrypt: 004158a3

7.0.0.1160
decrypt: 0041593e
encrypt: 00415893

7.0.0.1206
decrypt: 0041592e
encrypt: 00415883

7.3.0.1020
decrypt: 00417a1e
encrypt: 00417973

Example of assembly code at the decryption offset:

0041593E 51 PUSH ECX ; output buffer for the decryption
0041593F 68 08A24400 PUSH pccntmon.0044A208 ; ASCII "Windows7621673NT"
00415944 68 F4A14400 PUSH pccntmon.0044A1F4 ; ASCII "Virus3761267Trend"
00415949 8D95 0060FFFF LEA EDX,DWORD PTR SS:[EBP+FFFF6000]
0041594F 52 PUSH EDX ; encrypted hash
00415950 E8 4BF8FFFF CALL pccntmon.004151A0 ; the decryption function
00415955 83C4 10 ADD ESP,10
00415958 8D85 03C0FEFF LEA EAX,DWORD PTR SS:[EBP+FFFEC003] ; EAX points to the MD5 hash

The decrypted MD5 hash (so from encrypted hash to the original MD5 hash
of the password) will be pointed by EAX (the LEA instruction) and it's
just the string which starts from the third char of the output buffer.

Output buffer after the decryption:

1230123456789ABCDEF0123456789ABCDEF
| |
| MD5 hash
the 3 useless bytes

Since this is a MD5 hash there are some good chances to retrieve the
original password using an online MD5 cracker like the excellent service
at Milw0rm:

http://www.milw0rm.org/cracker/

A different thing instead are the proxy passwords which are handled
using the PWDDecrypt and PWDEncrypt functions in PWD.DLL.
This method is used by the Proxy_Pwd and Internet_Proxy_Pwd encrypted
strings in Ofcscan.ini and by the ProxyPwd password located in the
registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Pc-cillinNTCorp\CurrentVersion

I have not tested it but the result should be the plain-text password.


############################################################ ############