0

I recently came across an old website of mine that I had used the PageProtectionPlus MediaWiki extension to encrypt parts of. I'm curious to see what I wrote, but the extension is no longer supported and incompatible with updated MediaWiki and PHP. So I have to decrypt it "by hand", as it were. All I have to go on is the plaintext that got stored in the database. One example:

--- BEGIN KEY: RSA,c88e147b,BLOWFISH,CBC,56,8 ---

MXSmspeImtfWZ4sS4C48nAa5ZhT6SQnNnXmfJcGJhXGlTX4jc5D7WdhSwszJhIZ8PXrG99zHuEjh 012c09ytjiZVdK1aGTFJhXDDJYO/dtzcrFHVnPeWRmCky6DN1LuVMb8V4CbYhea97ZiwadVF+2kM BqTi1UhII/jx/UdEuq8=

--- END KEY ---

MpU/3GHcYc8rHqbeJSFNgz8uMIDD6c9l7Q3Grts7RjjWrMGoYdjvFYpy3fVKLielqFkX5O+5Ws4u 4YsaPGoEQCTlHnCMW8HrWl3jdp4ZP5o=

The good news is that the format is described in the documentation (at the link above) as follows:

--- BEGIN KEY: key_encryption_algorithm, key_encrypton_identifier, txt_encryption_algorithm, txt_encryption_mode, txt_encryption_key_size, txt_encryption_iv_size ---

BASE64 encoded & RSA-encrypted symmetric key with IV attached to it & with a few random bytes (salt - why not?)

--- END KEY ---

BASE64 encoded & symmetrically encrypted text body

I also have the RSA private key that was used (or at least I think I do). It feels weird sharing it too, but there's no reason to actually keep it private.

-----BEGIN RSA PRIVATE KEY----- MIICWAIBAAKBgLyI+PJuZhq7zUYNpDfsWUv8av8tsQNM2pVMFFGPGNXGayLNAoPH fZDMcatLpPCJi4l7qoHgBauNHYN787XzIBsG/cbx1roWrPb0b3mKb9GL36JDVJqk o2aUwAo+tbtJ8+l8UkT7BrOEClgaNV+izSV06CAAQrKem1IaxrJqUVVTAgMBAAEC gYBGuzCCa06dGvXxIS8J1/7MVh+iKnctYMjkmA1LZ98OXIlXHgiifdYq27iNZiy0 HTYfVyjp3qzh5mg7KuaMzXCubjpmSysTP3BD+Cwjcxxw5/XLQWiuq7ncflUmXnzW FJA3HSTp46qbcsZ05pTNPMdOZ4KsYOlqvuqAkwBxUR/SuQJA3+9vz//nCPc9Ny+/ n9d/lw/3z0+PX+/v74ff7/8PL2/333+cdyePX4+XvxHncdefNl+PbHj3Bpf/72/x z+8f7QJA14fnz78/T+9vX0Tfqu/n3+WHX3+Prxsvgi/MD8//r99f/zdPjy8v/28/ 3xfPWBeXL79il38vtycXbg8P98ciPwJAVTN9gE8mMTQYd3HUX9WXNvudVqQ3sdHR oXo6Cs8pkOvyDHg6KN/FXh99JfaC776RVhe/sw7HNhwJBam7AFlD9QJANxDaARHz sxCRe920549zxph2BcgphauEb9aWZFPYF68Sb7pJ8WM0+CYMQ4tpxjAAyIo1Pk+Y eUrbiZr/kWanMQJAR6dXJOZAhOX+9TMrFDJDu84YGBsU83GcuJtJ/lf+0ldpMx/v FIOSbYcYkFGZwA+4iJlN1V8lqQGn1DoiXkN2mg== -----END RSA PRIVATE KEY-----

Unfortunately, while I have a general understanding of how cryptography works, I lack the practical knowledge to figure out how to extract the information from this. (I'm sure openssl can do it, but I don't know how)

How can I extract my data from this plugin's format?

  • While it's not the answer you were looking for, if you can get an old version of MediaWiki that supports the extension, you should be able to recover the data by chucking a dump in after the decrypt is called? – Seidr Feb 19 '15 at 7:59
  • Also, by looking at the above spec, it states that the key has also been encrypted? This suggests you'd need a second key, that was used to encrypt the above key? Do you still have the source files for the old site available, as it's likely another key was stored in either a config file, or the DB. – Seidr Feb 19 '15 at 8:12
  • In specific, after putting together a small test case, you'll need the .PEM files from the 'keys' directory, or the '/var/run/PPP-keys' directory I believe. These are generated upon installation of the PageProtectionPlus package, and are likely used in above encryption of the key, which is used to decrypt the above cipher text. – Seidr Feb 19 '15 at 8:39
  • @Seidr - Yes, I have that key. That's what I was referring to when I said I had the RSA private key. I can add it to the question if it'll help. I did consider trying to get an old version of MediaWiki running, but I'd need to install an older version of PHP first. If I can do it manually, it seems easier, but that's my fallback plan. – Bobson Feb 19 '15 at 12:15
  • OK Hobson - I've been putting together a script to recover encrypted pages via the command line, but I don't think I can finish it today. I'd recommend the fallback option if you can't wait. Once it's finished I'll post it here anyway. – Seidr Feb 19 '15 at 13:05
2

You should place the below script in the ROOT directory of the PLUGIN (i.e. the one that contains the file 'PageProtectionPlus.php'.

The script takes one argument - a filename which contains your 'Cryptogramme', i.e. the block of text you provided above.

The script is anything but fast, but in my tests has been able to Encrypt and Decrypt text.

<?php
    require_once("Encryption.php");
    $cg = file_get_contents($argv[1]);
    $e = new Encryption();
    echo $me->Decrypt($cg);

Usage: php ppp-decrypt <filename>

Make sure the path in LocalSettings.php (which defines where your PPP keys are stored) is valid, and contains your keys. If the LocalSettings.php file does not exist in the root of the PPP plugin, you'll need to create it. Below is an example of what it should contain.

<?php

$wgCachePages   = false;
$wgCacheEpoch   = 'date +%Y%m%d%H%M%S';
$wgPEMsize      = 1024;                 //default key size
$wgPEMlite_size = 512;                  //lite key size
$wgPEMdir       = '/home/user/keys';  //storage for keys
$wgPEMfile      = 'default.pem';        //default key's filename
$wgPEMlite_file = 'lite.pem';           //lite key's filename

$wgPEMold       = 'private.pem';        //old key's pathname (optional)
                                        //if you've been using PageProtection

I'm also sure this is possible with openssl, but it looks like the PPP plugin does various other things with the encrypted key / data, so it was just easier to utilize their existing framework.

Make sure you backup your keys (the .pem files), as on occasion PPP looks like it clears out the key directory.

You may also need to install a few PHP packages, as below.

pear install Crypt_RSA-1.2.1
pear install Crypt_Blowfish-1.1.0RC2
apt-get install php5-mcrypt

Let me know how you get on :)

  • Ooh, this was a great idea. Unfortunately, it didn't work - I just got gibberish out (looks mostly like "could not decode character" marks). It could be that my private key is bad... now that poked at it more, I think I might vaguely remember giving up on said wiki because I lost access to the encrypted data. Still get a vote for trying, though! – Bobson Feb 20 '15 at 2:32
  • Hmm - if you didn't have the correct key it would of let you know. I'm sorry it didn't work for you. If you wish, I could have a crack at it, but would need your keys. If you don't want to share them I completely understand - only reason I suggest this is because you said this is for an old website. – Seidr Feb 20 '15 at 3:05
  • I hesitated, because "private keys are private" and I don't really know what the content is. But I know the context of it (which is safe, although it might be embarrassingly badly written) and that the keys shouldn't have been used for anything else. I'll edit it into the question. You're right about it letting me know, though (I just tried changing the key in the header and got an error). – Bobson Feb 20 '15 at 3:24
  • Looks like it's not the correct key them I'm afraid. Unless you can get access to the original key, it's going to be very hard to retrieve the data. It could of course be that my script does not access the methods correctly, but after performing test encrypt/decrypts, it does appear to work as expected. – Seidr Feb 20 '15 at 13:36
  • I'd still recommend setting up a copy of the software and seeing if you can retrieve the content that way - you never know. – Seidr Feb 20 '15 at 13:41
0

To dercrypt the content, the symmetric secret key is needed. It appears to have been encrypted via PKI... the RSA key reference.

Using the RSA private key, decrypt the sectet key. Using the same algorithm such as AES256 or whatever it was encrypted with... decrypt the content using the secret key.

  • I appreciate the suggestion, but this is about the limits of my own knowledge. I know that that's what I need to do, but I don't know what commands or utilities to use to actually do it. If you could provide examples of the right arguments to use, it'd be worth an upvote, at the least. – Bobson Feb 20 '15 at 2:34
  • My apologies but it not clear exactly what framework or PHP system is being used here. Further, PHP is not my field of expertise. Lastly, decrypting unknown content in an unknown system is well beyond the question/answer format of StackExchange. Suggest researching multiple topics about PHP, this framework and cryptography. – Darrell Teague Feb 21 '15 at 14:43
  • As best as I can tell, it's supposed to be standard RSA encryption of a symmetric key which is, in turn, used as the key to Blowfish-CBC encryption of the text. It ought not to have anything to do with PHP. That said, just because it ought not doesn't mean it doesn't. – Bobson Feb 22 '15 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.