PeopleSoft Token
I came upon an article concerning the PS_TOKEN vulnerability where an attacker can brute force the SHA1 signature value in order to obtain the node password for PeopleSoft systems using SSO.
Since my university uses PeopleSoft, I took a deeper look into how PS_TOKEN is generated and parsed.
Cookie Format
The value itself is encoded using base64 and looks something similar to:
AAAAqQECAwQAAQAAAAACvAAAAAAAAAAsAARTaGRyAgBOdwgAOAAuADEAMBSEI9HyVMA76K0KLjX552P1scTSuwAAAGkABVNkYXRhXXicHYtBDkBADEWfIZaWbkEGM8JasBMJNjaO4XIO58+06Wublw+8iUkzElTmCyy5Y19MDLT0WNHlzGysBTsHCyeP/OGkLA2eSnsU23g3itY4OjHYWuP1ucgf6kMMnw==
The actual format of the binary blob that I've found is:
0 : Int32 - length of the entire token
4 : Int32 - Some magic number
???
20 : Int32 Header Length
24 : 00 padding?
String - Header string (Shdr)
String - Unknown (N)
00 padding? - 1 byte
String - Version (8.10)
String - SHA1 Signature, 20 bytes as hex
Int32 - Data Section Length
00 padding? - 1 byte
String - Data Header (Sdata)
String - Data Value (zlib data. String values starting at 20 bytes in)
A String in the data section above is a byte value containing the string length followed by the string.
Parsing the cookie above produces the following values:
Full Length: 169
Magic Number: 16909060
Header Full Length: 44
Header String: Shdr
Unknown field N
Version: 8.10
Hash length is 20
Signature: 8423d1f254c03be8ada2e35f9e763f5b1c4d2bb
Data Length: 105
Data Header: Sdata
Data Value: ZZZUC826024
Data Value: ENG
Data Value: PSFT_CS
Data Value: 2015-09-25-18.43.15.553453
Signature Generation
According to Oracle's documentation, the SHA1 signature is generated using:
SHA1_Hash ( UserID + Lang + Date Time issued + Issuing System + Local Node Pswd )
Basically, the first 4 values which are given as part of the PS_TOKEN value (acting as the salt) is hashed with the node password in order to create a signature. This is then used on subsequent requests to the server to verify the person's identity. Since the salt and the hash is known, an offline brute force attack can be done in order to find the node password.
See Also
- Zlib compression header, used to store the data values. http://stackoverflow.com/questions/9050260/what-does-a-zlib-header-look-like
- http://docs.oracle.com/cd/E15645_01/pt850pbr0/eng/psbooks/tsec/chapter.htm?File=tsec/htm/tsec10.htm