IBM i Password Hashes Cracked: QSYRUPWD Cipher Reverse-Engineered
The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes
During a penetration test, the author discovered that IBM i's QSYRUPWD API returns encrypted password data that doesn't match existing John the Ripper formats for QPWDLVL 2-4. Using system tracing and disassembly, they traced the API's internal calls to a cipher routine that delegates to a supervisor call (SCV) with function number 346. By analyzing the LIC module #cfmir, they identified the underlying AES decryption process, enabling reconstruction of IBM i password hashes for strength testing.
The qsy_cipher function contains the following code: ... SCV 10 ... In this case, 346 (ADDI 10,0,346) is the decimal function number, but based on the number alone I did not know which internal function it represented.
- kencausey
Link stolen from calvin on lobste.rs. <https://lobste.rs/s/2dc0gb/cipher_behind_qsyrupwd_reconstruc...>