Websense / Forcepoint accessing tech-support and root accounts with frida

Forcepoint / Websense Appliance — Recovering tech-support & root passwords

We got rid of Websense / Forcepoint a while ago so I haven't had to use this in forever. But I'll leave this here in case anyone else has the misfortune of having to beg support for ssh / root access to fix their appliance.

1. Download the appliance recovery image iso from your forcepoint support hub. Mine was named VX-Appliance-RecoveryImage-856.iso.
2. Extract the files from the ISO, or extract your VMDK or other VM disk image. You're looking for a binary named wsra.
3. In the ISO it's in Packages/appliance-api-x.x.x.x86_64.rpm; there is also a debuginfo rpm if you want to debug the wsra binary.

After extracting the wsra executable from the rpm, you can use the frida script below to convert the tech-support and show_root tokens into the actual account passwords.

So after logging into your appliance you can do set account tech-support --status enabled, which will give you a passcode like AQ6m9h. Now run the frida script like:

frida -l frida.js -f wsra -P '{"code": "AQ6m9h"}' -- -o

…which will give you the tech-support password h9NxKV4M.

Now login as tech-support and do show_root; this will give you another passcode like 8zRQH8. Do the same thing with the frida script to get the real root password, 3LV55wGU.

Now you can fix whatever random issue the appliance is having without having to wait forever for support.

From what (little) I remember, the passcodes are deterministic in a rot13 kind of way. So we reuse the obfuscation function in the real wsra binary to just do the same operation again.

Basically patch the random character generating function to return our static passcode. So instead of obfuscating the real password into the passcode, it's (de)obfuscating the passcode into the real password.

// frida -l frida.js -f wsra -P '{"code": "AAAAAA"}' -- -o

const ENTRY_PTR = "0x0040258f";
const PREMD5_PTR = "0x00402784";
var CODE = 'AAAAAA';

rpc.exports = {
    init(stage, params) {
        console.log(JSON.stringify(params));
        CODE = params['code'];
    }
};

Interceptor.attach(ptr(ENTRY_PTR),
        function(args) {
          const codebuf = Memory.allocUtf8String(CODE);
          Memory.copy(this.context.rdi, codebuf, CODE.length+1);
        }
);

Interceptor.attach(ptr(PREMD5_PTR),
        function(args) {
          console.log(`\n\n${CODE} -> ${ptr(this.context.rdi).readCString()}\n`);
        }
);