Sonatype NEXUS Repository Manager stored variable decryptor

decrypt.py

import hashlib
import base64
import argparse
from Crypto.Cipher import AES

class AES_pkcs5:
    def __init__(self, key: str, mode: AES.MODE_ECB = AES.MODE_ECB, block_size: int = 16):
        self.key = self.setKey(key)
        self.mode = mode
        self.block_size = block_size

    def pad(self, byte_array: bytearray):
        """
        pkcs5 padding
        """
        pad_len = self.block_size - len(byte_array) % self.block_size
        return byte_array + (bytes([pad_len]) * pad_len)

    # pkcs5 - unpadding
    def unpad(self, byte_array: bytearray):
        return byte_array[:-ord(byte_array[-1:])]

    def setKey(self, key: str):
        return key

    def decrypt(self, message: str, iv) -> str:
        cipher = AES.new(self.key, AES.MODE_CBC, iv)
        # decrypt and decode
        decrypted = cipher.decrypt(message)
        print(f'{decrypted}')
        # unpad - with pkcs5 style and return
        return self.unpad(decrypted)

def main():
    parser = argparse.ArgumentParser(description="Decrypt Sonatype NEXUS stored variables from pcl files.")
    parser.add_argument("-p", "--passphrase", default="CMMDwoV", help="Passphrase to decrypt stored Sonatype NEXUS variable."
                                                              " Default is: CMMDwoV.")
    parser.add_argument("-s", "--svar", required=True, help="Base64 encoded value of the stored variable "
                                         "(i.e. X4bkkyyxOxkH+JFw6vVV3Gp0ONzT0aSzGOUCSSH+P5E=).")
    parser.add_argument("-v", "--verbose", action='store_true', help="Verbosity flag.")

    args = parser.parse_args()

    m = hashlib.sha256()
    passphrase = args.passphrase

    blob = base64.b64decode(args.svar)

    SALT = blob[:8]
    PAD = blob[8:9]
    enc = blob[9:len(blob)-16+9]
    if args.verbose:
        print(f'SALT:\t{SALT.hex()}')
        print(f'PAD:\t{PAD.hex()}')
        print(f'ENC:\t{enc.hex()}')

    cPos = 0
    #genkey and IV
    m.update(passphrase.encode())
    m.update(SALT)
    result = m.digest()
    iv = result[16:]
    key = result[:16]

    if args.verbose:
        print(f'SHA256:\t{result.hex()}')
        print(f'L(SHA):\t{len(result)}')
        print(f'KEY:\t{key.hex()}')
        print(f'IV:\t\t{iv.hex()}')

    AES_pkcs5_obj = AES_pkcs5(key)
    decrypted_message = AES_pkcs5_obj.decrypt(enc,iv)
    print(decrypted_message)

if __name__ == '__main__':
    main()