Vulnerable Systems:
* Google Active Directory Sync (GADS) Tool Platform 3.1.3 and prior
Due to a weakness in the way the Java encryption algorithm (PBEwithMD5andDES) has been implemented in the GADS tool all
stored credentials can be decrypted into plain-text. This includes all of the encrypted passwords stored in any end-users
saved XML configuration file, such as Active Directory accounts, SMTP, Proxy details, LDAP and OAuth tokens, etc.
Proof of Concept:
Using the following information from the XML and GADS tool to decrypt all encrypted passwords from any XML:
1. The hard coded salt: SALT[] = { -87, -101, -56, 50, 86, 53, -29, 3 }
2. The hard coded DES interation count: ITERATION_COUNT = 20
3. The Secret key derived from the uniqueID value in the XML: 6512630db9a74d90a5531f574b85f398
4. The cipher-text from the XML: 1edOUtamjNA=
5. The algorithm: PBEwithMD5andDES
