Category Archives: Windows

How to decrypt Plesk passwords on Windows

February 8, 2021 Kirill Nikolaev 2 Comments

Plesk uses symmetrical encryption for many passwords in its internal MySQL database “psa”. There are several decryption scripts exist, but none for Plesk on Windows so far. This blog post is to finally change it.

You can find symmetrically encrypted passwords in these tables in Plesk’s “psa” database:

accounts (collumn password)
databaseservers (collumn admin_password)
dsn (collumn cstring)
longtaskparams (a record called oldBackupkey – a parameter for backup-encrypt-task (see the longtasks table))
misc (collumn aps_password)
servicenodeconfiguration (collumn value for the section MailGate / password)
smb_users (collumn password)

Symmetrically encrypted passwords look like this: “$AES-128-CBC$ABNK35ZcqnbTYT4Q3mbaEA$HmGDWmtym6K3+kJ8uBoJOg”:
They start with “$AES-128-CBC$”. Then between the second and the third dollar signs there is an AES initialization vector. After that, until the end of the string, we have the encrypted data itself.

In Linux the symmetric key, which Plesk uses to encrypt all these passwords, is located in /etc/psa/private/secret_key. In Windows they put it in registry: HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key\sym_key

To retrieve an encrypted password, use your favorite MySQL tool to connect to the database and copy it from there.

Note

To learn how to connect to the “psa” database, see this and also here.

Copy a password you want to decrypt and pass in to the -EncryptedString parameter of the script below. Mind, that you must run the script on the same server where you have that instance of Plesk installed, otherwise it won’t be able to extract the symmetric key. If you want to decrypt passwords on a different machine, you need to pass the symmetric key manually to the script’s -SymmetricKey parameter.

<#
.SYNOPSIS
    Decrypts passwords symmetrically encrypted by Plesk on Windows.
.DESCRIPTION
    Plesk uses symmetrical encryption for many passwords in its internal MySQL database "psa". With the help of this script you can now decrypt them for Plesk running on Windows as well.
.PARAMETER EncryptedString
    An encrypted string you found Plesk's psa database
.PARAMETER SymmetricKey
    Plesk symmetric encryption key. You can find it at HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key\sym_key, but this script extracts it automatically.
.EXAMPLE
    ConvertFrom-PleskSymmetricallyEncryptedString.ps1 -EncryptedString '$AES-128-CBC$ABNK35ZcqnbTYT4Q3mbaEA$HmGDWmtym6K3+kJ8uBoJOg'
.OUTPUTS
    [string]
.NOTES
    Author: Kirill Nikolaev
    Twitter: @exchange12rocks
    Web-site: https://exchange12rocks.org
    GitHub: https://github.com/exchange12rocks
.LINK
    https://exchange12rocks.org/2021/02/08/how-to-decrypt-plesk-passwords-on-windows/
.LINK
    https://github.com/exchange12rocks/PS/blob/master/ConvertFrom-PleskSymmetricallyEncryptedString.ps1
.LINK
    https://mor-pah.net/2014/03/05/decrypt-plesk-11-passwords/
.LINK
    https://codeforcontent.com/blog/using-aes-in-powershell/
#>

#Requires -Version 3.0

Param (
    [Parameter(Mandatory)]
    [string]$EncryptedString,
    [byte[]]$SymmetricKey = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key' -Name sym_key).sym_key
)

$EncryptedStringSplitted = $EncryptedString.Split('$')
$IV = $EncryptedStringSplitted[2]
$Data = $EncryptedStringSplitted[3]

$IVRemainder = $IV.Length % 4
if ($IVRemainder) {
    $IV = $IV.PadRight($IV.Length + $IVRemainder, '=')
}
$DataRemainder = $Data.Length % 4
if ($DataRemainder) {
    $Data = $Data.PadRight($Data.Length + $DataRemainder, '=')
}

$AESCipher = New-Object -TypeName 'System.Security.Cryptography.AesCryptoServiceProvider'
$AESCipher.Key = $SymmetricKey

$EncryptedBytes = [System.Convert]::FromBase64String($Data)
$AESCipher.IV = [System.Convert]::FromBase64String($IV)

$Decryptor = $AESCipher.CreateDecryptor()
$UnencryptedBytes = $Decryptor.TransformFinalBlock($EncryptedBytes, 0, $EncryptedBytes.Length)
[System.Text.Encoding]::UTF8.GetString($UnencryptedBytes)

.SYNOPSIS

Decrypts passwords symmetrically encrypted by Plesk on Windows.

.DESCRIPTION

Plesk uses symmetrical encryption for many passwords in its internal MySQL database "psa". With the help of this script you can now decrypt them for Plesk running on Windows as well.

.PARAMETER EncryptedString

An encrypted string you found Plesk's psa database

.PARAMETER SymmetricKey

Plesk symmetric encryption key. You can find it at HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key\sym_key, but this script extracts it automatically.

.EXAMPLE

ConvertFrom-PleskSymmetricallyEncryptedString.ps1 -EncryptedString '$AES-128-CBC$ABNK35ZcqnbTYT4Q3mbaEA$HmGDWmtym6K3+kJ8uBoJOg'

.OUTPUTS

[string]

.NOTES

Author: Kirill Nikolaev

Twitter: @exchange12rocks

Web-site: https://exchange12rocks.org

GitHub: https://github.com/exchange12rocks

.LINK

https://exchange12rocks.org/2021/02/08/how-to-decrypt-plesk-passwords-on-windows/

.LINK

https://github.com/exchange12rocks/PS/blob/master/ConvertFrom-PleskSymmetricallyEncryptedString.ps1

.LINK

https://mor-pah.net/2014/03/05/decrypt-plesk-11-passwords/

.LINK

https://codeforcontent.com/blog/using-aes-in-powershell/

#Requires -Version 3.0

Param (

[Parameter(Mandatory)]

[string]$EncryptedString,

[byte[]]$SymmetricKey = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\PLESK\PSA Config\Config\sym_key' -Name sym_key).sym_key

)

$EncryptedStringSplitted = $EncryptedString.Split('$')

$IV = $EncryptedStringSplitted[2]

$Data = $EncryptedStringSplitted[3]

$IVRemainder = $IV.Length % 4

if ($IVRemainder) {

$IV = $IV.PadRight($IV.Length + $IVRemainder, '=')

}

$DataRemainder = $Data.Length % 4

if ($DataRemainder) {

$Data = $Data.PadRight($Data.Length + $DataRemainder, '=')

}

$AESCipher = New-Object -TypeName 'System.Security.Cryptography.AesCryptoServiceProvider'

$AESCipher.Key = $SymmetricKey

$EncryptedBytes = [System.Convert]::FromBase64String($Data)

$AESCipher.IV = [System.Convert]::FromBase64String($IV)

$Decryptor = $AESCipher.CreateDecryptor()

$UnencryptedBytes = $Decryptor.TransformFinalBlock($EncryptedBytes, 0, $EncryptedBytes.Length)

[System.Text.Encoding]::UTF8.GetString($UnencryptedBytes)

PSA: Meltdown Patches (CVE-2017-5715, CVE-2017-5754) Could Cause Problems With Hyper-V Live Migration

January 10, 2018 Kirill Nikolaev Leave a comment

Suppose you have two Hyper-V servers: On the first server (Server A) you installed both 2018-01 Rollup Update and an updated BIOS release. On the second server (Server B) you installed only the Rollup Update. You added FeatureSettingsOverride, FeatureSettingsOverrideMask, and MinVmVersionForCpuBasedMitigations registry keys to both hosts. Then you rebooted both machines.

On Server A you have a virtual machine. That VM was (re-)booted on that server after the BIOS update and the Rollup Update were installed. Get-SpeculationControlSettings shows that all mitigations are enabled for the machine.
You try to live-migrate the virtual machine from Server A to Server B.

In that case, live migration will complete successfully, but the VM will freeze and won’t be available neither via network, nor via the Hyper-V console.

Solution:

To resume normal VM work, you should either to:

Move the VM back from Server B to Server A. It should un-freeze automatically.
Forcefully restart the VM using Hyper-V Management snap-in or PowerShell cmdlets at Server B.

I tested it with Windows Server 2012 R2 only, the VM was Windows Server 2016. Not sure if it applies to Server 2016 hypervisors.

ADDS, PowerShell, Windows Server 2016

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 4 — AGPM

October 31, 2017 Kirill Nikolaev 1 Comment

Previous part — Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 3 — Management Infrastructure

Introduction

When we talk about control version systems (CVS), the first thing comes to mind is, of course, program code. In the modern world, one cannot be a decent software developer if they do not use Git or TFS or Mercurial or Subversion etc. But this does not mean only developers benefit from the concept of CVS: Adobe provides designers with its own solutions to manage file versions.
What about us, IT administrators? Given the growing popularity of the infrastructure-as-a-code concept, many IT administrators have already adopted some kind of CVS to store scripts and configurations files.

Today I want to talk about version control for group policies. You probably know that group policies are not exactly text files, therefore, traditional CVSes are not the best choice here. That’s why Microsoft came up with its own solution, which allows us to track changes, compare GPO versions and quickly restore the previous ones: Advanced Group Policy Management (AGPM).

Interesting, that it is not just a CVS, but is also a tool to delegate group policies administration with built-in approval management mechanism.
But even if you work in a small team and do not need GPO management delegation, I still encourage you to use AGPM as a version control system.

AGPM is a part of Microsoft Desktop Optimization Pack, which is a free software set available to Microsoft Software Assurance subscribers. Here’s the official documentation where you can learn more about the product.

Warning

AGPM is NOT a substitute for a proper Active Directory backup.

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 3 — Management Infrastructure

October 31, 2017 Kirill Nikolaev 1 Comment

Previous part — Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 2 — Post-Config

Introduction

Sorry it took me so long — a lot has happened in the last six months, including moving into another country and changing jobs. Also, as you can see from several previous posts, I got a little bit carried away with PowerShell.
Another thing with which I got carried away is this post: I even had to split it, eventually. That’s why today, I present you not one, but two blogs at once! Find the next one here: Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 4 — AGPM

Up to this point, we were working on our servers interactively, locally. This is considered not the best practice because you consume server resources to support an interactive logon session. Also it might be inconvenient when you manage a fleet of servers.
In this article we will setup remote management administrative stations, which we will use to manage servers in the lab from then on.

Function to download updates from Microsoft Catalog

October 2, 2017 Kirill Nikolaev 4 Comments

Last week, I accidentally built a function which downloads update files from Microsoft Update Catalog. What is its real-life application?
Say you are building an OS installation image from scratch, which will then be deployed en masse. Common approach is to integrate all available updates into such image, to increase security and decrease post-installation tasks duration.
For Windows Server 2012 R2 and earlier OSes you have to download and integrate dozens of updates, but you are not sure which ones are required for your installation image (Windows Server 2012 R2 ISO-image has been rebuilt at least three times). The only way to determine which updates to integrate is to install a fresh computer from an ISO-image, connect it to the Internet and check for updates from Microsoft Update.
We can script it as follows:

$Criteria = "IsInstalled=0 and Type='Software'"
$Searcher = New-Object -ComObject Microsoft.Update.Searcher
$SearchResult = $Searcher.Search($Criteria).Updates

$Criteria = "IsInstalled=0 and Type='Software'"

$Searcher = New-Object -ComObject Microsoft.Update.Searcher

$SearchResult = $Searcher.Search($Criteria).Updates

$SearchResult object will contain a list of updates which your machine requires.

To integrate those updates, you need to receive their .msu or .cab files. Unfortunately there is no way (at least known to me) to extract download links from the $SearchResult object. Here’s where the new Get-WUFileByID function comes to help:
First, you have to get a list of KB IDs from the $SearchResult object:

[string[]]$KBIDs = ''
($SearchResult | Select-Object Title).Title | ForEach-Object {
    $null = $_ -match '^.+\(KB(\d+)\)$'
    $KBIDs += $matches[1]
}

[string[]]$KBIDs = ''

($SearchResult | Select-Object Title).Title | ForEach-Object {

$null = $_ -match '^.+$KB(\d+)$$'

$KBIDs += $matches[1]

}

Then you just pass each one of these to the function and it will download the files:

foreach ($ID in $KBIDs) {
    Get-WUFileByID -KD $ID -SearchCriteria 'Windows Server 2012 R2'
}

foreach ($ID in $KBIDs) {

Get-WUFileByID -KD $ID -SearchCriteria 'Windows Server 2012 R2'

}

In the -SearchCriteria parameter, specify a product for which you need to download updates.

As the result, updates will be downloaded to the current catalog (you can redirect them with -DestinationDirectory parameter).
At last, integrrate the updates with help of Add-WindowsPackage cmdlet.

If you do not want to download any files, but wish to receive links only, -LinksOnly switch is here just for that!

The function is covered by tests and available at GitHub. Should you have any questions of suggestions, feel free to leave them in the comments section or raise an issue.

PowerShell, Windows

New features for the DNS Synchronization script

September 5, 2017 Kirill Nikolaev Leave a comment

Hi guys,
Sorry for the delay: a huge change has happened in my life recently — I moved from Moscow, Russia to Limassol, Cyprus, where I now live and work.
I am still polishing the next part of the “Command-line Infrastructure” series, and today I am here to present you another significant update to the DNS Zones Synchronization script:

Name query modes introduced. Right now, here are two modes:
- “1” – The script will try to retrieve authoritative nameservers for a zone and then will you them to resolve records in that zone.
- “0” – The script will use nameservers specified in the config file.
Specify the required mode for each zone in the new column conveniently named “Mode”. Also, instead of specifying “0”, you can leave the column empty.
This has led to another new feature: From now on, the script supports not only IP addresses as NS servers, but DNS names too. Therefore, “ExtIP” and “IntIP” columns in the configuration file have been renamed to “ExtNS” and “IntNS”.
Even more: you can now leave external nameserver field (ExtNS) empty. In that case, the script will use default operating system DNS servers.

Here is a table for you to better understand how these new features work together:

Mode	ExtNS Type	Result
0	IP Address	Names in the zone resolved using ExtNS IP address.
1	IP Address	ExtNS IP address used to find authoritative NSes for the zone. The first authoritative NS then used to resolve names in the zone.
0	DNS Name	Default OS DNS servers used to resolve ExtNS DNS name to an IP address. This IP address then used to resolve names in the zone.
1	DNS Name	Default OS DNS servers used to resolve ExtNS DNS name to an IP address. This IP address then used to find authoritative NSes for the zone. The first authoritative NS then used to resolve names in the zone.
0	Empty	Names in the zone resolved using default OS DNS servers.
1	Empty	Default OS DNS servers used to find authoritative NSes for the zone. The first authoritative NS then used to resolve names in the zone.

Note, that a query mode does not affect the internal name server at all. Here’s a table for the “IntNS” column as well:

IntNS Type	Result
IP Address	Requests are sent to this IP address.
DNS Name	Default OS DNS servers used to resolve IntNS DNS name to an IP address. Then requests are sent to this IP address.
Empty	An new error is raised. Event ID 52.

As usual, grab the latest release of the script from GitHub!

PowerShell, Windows

Small update to my DNS Synchronizer script

June 4, 2017 Kirill Nikolaev Leave a comment

I’ve just released a small improvement to my DNS Synchronizer script. The update includes:

Corrected the issue where sub-records of a record prevented that record to be synchronized.
Corrected the way how start and end times are formatted — now they both are formatted equally.
But the most significant one for the end-user, is that the script has been renamed to Sync-DNSZones, in accordance with PowerShell best practices.

If you execute the Get-Verb cmdlet w/o parameters, you’ll see that there is no “Synchronize” verb in the output — that’s why I renamed the script. Do not forget to rename “-NS” an “-REC” files accordingly.

ADDS, PowerShell, Windows Server 2016

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 2 — Post-Config

April 11, 2017 Kirill Nikolaev 1 Comment

Previous part — Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 1 — Installation

Introduction

In this post we will perform two configurations on our Active Directory Domain Services instance: We’ll define security tiers which later become cornerstones of our privilege delegation principles and we’ll tune domain-joining parameters. Also a quick tweak for the DNS service.

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 1 — Installation

March 6, 2017 Kirill Nikolaev 3 Comments

Introduction

Up to this day, Active Directory Domain Services (AD DS) has been the core of the Windows infrastructure. With each release of Windows Server, AD DS receives new features while keeping great backward compatibility. Windows Server 2016 brings following enhancements to AD DS:

In this blog we shall install the corner stone of our future infrastructure: a highly-available AD DS instance of two domain controllers. Our AD DS layout is going to be quite simple: two writable domain controllers in a single site.

Building Highly-Available Windows Infrastructure: Command-line Style

March 6, 2017 Kirill Nikolaev Leave a comment

Several months ago Windows Server 2016 was released. With this release Microsoft has made two significant changes in Windows Server installation options:

Nano Server was introduced
Server with a GUI now includes desktop experience features (it is even called “Server with Desktop Experience”) and there is no supported way to remove them. This should force IT Administrators to deploy Server Core more broadly.

Looks like now is a good time to stop thinking about Windows Server as a GUI based system and pivot your management approach to be more command-line.
This post is the first in a series of how to build your own highly-available Windows infrastructure using just PowerShell and some other command-line tools. I plan to discuss the following components:

Active Directory Domain Services,
Active Directory Certificate Services,
Desired State Configuration,
Key Management Services,
DHCP,
SCDPM,
SCCM,
Exchange Server,
And, possibly, S4B Server, as well.

I am not able to deploy Hyper-V hosts yet, as all my infrastructure is purely virtual and the host machine, sadly, is running Windows Server 2012 R2 and currently it is impossible for me to upgrade it.

All PowerShell code will not use any hardcoded values. Instead, at the beginning of each post, I shall include a set of variables which will allow you to easily recreate the infrastructure in your environment w/o any change in the code.

The first part is already here! Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 1 — Installation

Microsoft Technologies and Stuff

Category Archives: Windows

How to decrypt Plesk passwords on Windows

Note

See also:

PSA: Meltdown Patches (CVE-2017-5715, CVE-2017-5754) Could Cause Problems With Hyper-V Live Migration

Solution:

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 4 — AGPM

Introduction

Warning

In this article:

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 3 — Management Infrastructure

Introduction

In this article:

Function to download updates from Microsoft Catalog

New features for the DNS Synchronization script

Small update to my DNS Synchronizer script

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 2 — Post-Config

Introduction

In this article:

Building Highly-Available Windows Infrastructure: Command-line Style. AD DS. Part 1 — Installation

Introduction

In this article:

Building Highly-Available Windows Infrastructure: Command-line Style