Computer Associates eTrust Intrusion Detection 1.4.1.13 - Weak Encryption

                							

                source: http://www.securityfocus.com/bid/1341/info

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings.

Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

This password along with the key is stored in the following registry location:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\SessionWall\1.0\Security\AdminPassword

The first byte will be the length of the key (n), the next (n) bytes are the key, the remaining bytes are the encrypted password with the exception of the last byte which is a terminating null. 

20012-1.exe - Administrator password decryptor for Win 9x/NT.
20012-2.zip - Source code (use TASM). 

https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/20012-1.exe

https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/20012-2.zip