How to decrypt Jenkins passwords from credentials.xml?

Question

I've taken over the project where a lot of Jenkins credentials has passwords or passphrase strings which I need to know in order to progress with the project, unfortunately these weren't documented anywhere.

I've checked the credentials.xml file where these credentials are stored, but they're in not plain text, e.g.:

<passphrase>{AAAAAAAAAAAANzxft/rDzyt8mhxpn3O72dxvVqZksL5vBJ4jNKvAjAA=}</passphrase>

^{Note: I've changed it slightly for privacy reasons.}

How can I decrypt its original password based on the string above?

I am getting error with the proposed answer: println(hudson.util.Secret.decrypt("{{xxx/wwww+yyyy/zzzz=}}")) The + symbol is breaking the script. Any suggestion? — Jay Bau
– Jay Bau, Commented Jun 14, 2019 at 17:35
@JayBau Try with single brackets: "{...}", remove extra once. — kenorb
– kenorb, Commented Jun 17, 2019 at 11:37
This is practically a duplicate of an SO question: stackoverflow.com/questions/37683143 (although technically it would only qualify as a duplicate if the linked question was asked on DevOps). — Attila Csipak
– Attila Csipak, Commented Mar 5, 2020 at 9:46

kenorb · Accepted Answer · 2017-09-28 22:15:34Z

Luckily there is a hudson.util.Secret.decrypt() function which can be used for this, so:

In Jenkins, go to: /script page.

Run the following command:

println(hudson.util.Secret.decrypt("{XXX=}"))

or:

println(hudson.util.Secret.fromString("{XXX=}").getPlainText())

where {XXX=} is your encrypted password. This will print the plain password.

To do opposite, run:

println(hudson.util.Secret.fromString("some_text").getEncryptedValue())

^{Source: gist at tuxfight3r/jenkins-decrypt.groovy.}

Alternatively check the following scripts: tweksteen/jenkins-decrypt, menski/jenkins-decrypt.py.

For more details, check: Credentials storage in Jenkins.

+1, for secret files that use SecretBytes class, you can see my answer. — akostadinov
– akostadinov, Commented Feb 19, 2020 at 11:13

akostadinov · Accepted Answer · 2020-04-14 00:58:30Z

Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.

com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{ it.properties.each { prop, val -> if (prop == "secretBytes") { println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n") } else { println(prop + ' = "' + val + '"') } } println("-----------------------") }

A more complicated version that lists for non-system credential providers:

import com.cloudbees.plugins.credentials.CredentialsProvider import com.cloudbees.plugins.credentials.Credentials import com.cloudbees.plugins.credentials.domains.Domain import jenkins.model.Jenkins def indent = { String text, int indentationCount -> def replacement = "\t" * indentationCount text.replaceAll("(?m)^", replacement) } Jenkins.get().allItems().collectMany{ CredentialsProvider.lookupStores(it).toList()}.unique().forEach { store -> Map<Domain, List<Credentials>> domainCreds = [:] store.domains.each { domainCreds.put(it, store.getCredentials(it))} if (domainCreds.collectMany{ it.value}.empty) { return } def shortenedClassName = store.getClass().name.substring(store.getClass().name.lastIndexOf(".") + 1) println "Credentials for store context: ${store.contextDisplayName}, of type $shortenedClassName" domainCreds.forEach { domain , creds -> println indent("Domain: ${domain.name}", 1) creds.each { cred -> cred.properties.each { prop, val -> println indent("$prop = \"$val\"", 2) } println indent("-----------------------", 2) } } }

How to modify this to get credentials from all domains, from all folders ? — jmary
– jmary, Commented Aug 14, 2019 at 9:47
if you want an even simpler oneliner: com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')} — ymajoros
– ymajoros, Commented Jan 17, 2020 at 10:36
In a very old Jenkins implementation replace Jenkins.get() with Jenkins.getActiveInstance() — guymi
– guymi, Commented Oct 10, 2021 at 13:20

2 revs, 2 users 67% · Accepted Answer · 2022-07-13 08:37:20Z

Based on Magnus' answer but as a simple one-liner with still readable output:

com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}

akostadinov · Accepted Answer · 2021-10-11 15:01:11Z

@kenorb example with hudson.util.Secret is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner).

These do not handle secret files though where secretBytes are used and still an encrypted string is shown. In such case the SecretBytes class needs to be used. Assuming the file is UTF-8, one can do:

secret = "{....}" new String(com.cloudbees.plugins.credentials.SecretBytes.fromString(secret).getPlainData())

HTH

Update: This is the full solution from my gits:

com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{ it.properties.each { prop, val -> if (prop == "secretBytes") { println(prop + "=>\n" + new String(com.cloudbees.plugins.credentials.SecretBytes.fromString("${val}").getPlainData()) + "\n") } else { println(prop + ' = "' + val + '"') } } println("-----------------------") }

jmary · Accepted Answer · 2019-08-16 09:04:52Z

For the record, The following snippet to be pasted into the console also does the job :

def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class, Jenkins.instance, null, null ) for(c in creds) { if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey){ println(String.format("id=%s desc=%s key=%s\n", c.id, c.description, c.privateKeySource.getPrivateKeys())) } if (c instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl){ println(String.format("id=%s desc=%s user=%s pass=%s\n", c.id, c.description, c.username, c.password)) } }

Stack Exchange Network

How to decrypt Jenkins passwords from credentials.xml?

5 Answers 5

Linked

Hot Network Questions

How to decrypt Jenkins passwords from credentials.xml?

5 Answers 5

Linked

Related

Hot Network Questions