3

I'm using Jenkins with DC/OS (Mesos) and the service doesn't have a standard login but instead uses Mesos/Zookeeper for authentication. I'm can access JENKINS_HOME and have the config files for each user. I see the config.xml and also see the secret.key. I found this code:

https://github.com/abrindeyev/jenkins-helpers/blob/master/bin/get_api_token.rb

whose purpose is to decode the Jenkins API Token from the config. However, when I run this I get the following error:

/root/decrypt_api.rb:28:in `final': wrong final block length (OpenSSL::Cipher::CipherError)
from /root/decrypt_api.rb:28:in `decrypt'
from /root/decrypt_api.rb:35:in `<main>'

Here's an example Token and Key (from a Docker Jenkins test container):

Cipher in config.xml: 

<jenkins.security.ApiTokenProperty>
<apiToken>{AQAAABAAAAAwrkIhJkGOx+QkqgJ/Ep8NhecxeWcqAs78RI9v5kr8y1FSCJBA4YFHrneQGxmetsj3/xSywFRXItIbtuCufWR6ng==}</apiToken>
</jenkins.security.ApiTokenProperty>

Secret Key: 

bdafc86eae946c35ca57d3af02a82b733741d59e1eca44e0a3f7ef0b8f25f8e6

How can I decode the Token with the cipher and the key?

Ken J
  • 4,312
  • 12
  • 50
  • 86
  • Please tell me you've not actually just gone and posted your token and key here? You're going to want to change those after you get your answer. – Clint Jun 22 '17 at 20:19
  • As I've mentioned in the post this is from a Docker container that I've just spun up. I'm not using this instance for anything but testing. – Ken J Jun 22 '17 at 20:28
  • Possible duplicate of [Extract passphrase from Jenkins' credentials.xml](https://stackoverflow.com/questions/37683143/extract-passphrase-from-jenkins-credentials-xml) – kenorb Dec 20 '17 at 19:49

2 Answers2

1

You can decode Jenkins token by going to Script Console in your master node (or go to /script), then run the following command:

println(hudson.util.Secret.decrypt("{XXX=}"))

Note: Replace {XXX=} with your token string.

To decrypt it without using Jenkins, checkout these scripts: tweksteen/jenkins-decrypt, menski/jenkins-decrypt.py.

Related:

kenorb
  • 155,785
  • 88
  • 678
  • 743
0

go to http://jenkins-host/script

hashed_pw='your-sercret-hash-S0SKVKUuFfUfrY3UhhUC3J'
passwd = hudson.util.Secret.decrypt(hashed_pw)
println(passwd)

it should decrypt your token

Most Wanted
  • 6,254
  • 5
  • 53
  • 70