Netscaler-Cookie-Decryptor/nsccookiedecryptBulk.py at master · catalyst256/Netscaler-Cookie-Decryptor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
import re

import string

from string import ascii_letters


def parseCookie(cookie):

    """Parse Citrix NetScaler cookie

    @param cookie: Citrix NetScaler cookie

    @return: Returns ServiceName, ServerIP and ServerPort

    """

    s = re.search(

        'NSC_([a-zA-Z0-9\-\_\.]*)=[0-9a-f]{8}([0-9a-f]{8}).*([0-9a-f]{4})$', cookie)

    if s is not None:

        servicename = s.group(1)  # first group is name ([a-z\-]*)

        serverip = int(s.group(2), 16)

        serverport = int(s.group(3), 16)

    else:

        raise Exception('Could not parse cookie')

    return servicename, serverip, serverport


def decryptServiceName(servicename):

    """Decrypts the Caesar Subsitution Cipher Encryption used on the Netscaler Cookie Name

    @param cookie Citrix NetScaler cookie

    @type cookie: String

    @return: service name

    """

    # This decrypts the Caesar Subsitution Cipher Encryption used on the Netscaler Cookie Name

    trans = str.maketrans('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ',

                          'zabcdefghijklmnopqrstuvwxyZABCDEFGHIJKLMNOPQRSTUVWXY')

    realname = servicename.translate(trans)

    return realname


def decryptServerIP(serverip):

    """Decrypts the XOR encryption used for the Netscaler Server IP

    @param cookie Citrix NetScaler cookie

    @type cookie: String

    @return: XORed server IP based on ipkey

    """

    ipkey = 0x03081e11

    decodedip = hex(serverip ^ ipkey)

    t = decodedip[2:10].zfill(8)

    realip = '.'.join(str(int(i, 16))

                      for i in ([t[i:i+2] for i in range(0, len(t), 2)]))

    return realip


def decryptServerPort(serverport):

    """Decrypts the XOR encryption used on the Netscaler Server Port

    @param cookie Citrix NetScaler cookie

    @type cookie: String

    @return: XORed server port

    """

    portkey = 0x3630

    # no need to convert to hex since an integer will do for port

    decodedport = serverport ^ portkey

    realport = str(decodedport)

    return realport


def decryptCookie(cookie):

    """Make entire decryption of Citrix NetScaler cookie

    @param cookie: Citrix NetScaler cookie

    @return: Returns RealName, RealIP and RealPort

    """

    servicename, serverip, serverport = parseCookie(cookie)

    realname = decryptServiceName(servicename)

    realip = decryptServerIP(serverip)

    realport = decryptServerPort(serverport)

    return realname, realip, realport


if __name__ == '__main__':

    # Open the input file for reading

    with open('input.txt', 'r') as f:

        # Read the lines of input from the file

        lines = f.readlines()


    # Open the output file for writing

    with open('output.txt', 'w') as f:

        # Process each line and write the output to the file

        for line in lines:

            # Strip the newline character from the line

            line = line.strip()

            realname, realip, realport = decryptCookie(line)

            f.write(

                f'NSC: {line}\n'

                f'vServer Name={realname}\nvServer IP={realip}\nvServer Port={realport}\n\n')