Where is the encryption "password" for auto-encrypted WS_FTP SSH private SSH keys?

Question

I'm using WS_FTP to Automatically transfer files between my system and a large bank over FTPS.

When I browse to C:\Documents and Settings\Username\Application Data\Ipswitch\WS_FTP\SSH\ClientKeyStore I see the private and public key in TXT format.

I'm attempting to export these raw keys and import them into a new FTPS client, however the private key is secured using a private key I never typed in. To be sure of this, I created a new SSH key, and again saw that the private key was also created using a key I didn't type.

I can only assume that the text password required for SSH private keys is managed by WS_FTP itself, and after a call with tech support, they were unable to assist me either.

Where can I get the private key for WS-FTP SSH keys?

score 2 · Answer 1 · answered Mar 07 '19 at 21:34

I know this is an old thread but I spent a lot of time trying to figure this out and I couldn't find any guides online apart from this post. Martin was on the right path except for the base64 encoding on the passphrase. It turns out the encoding is a little bit more complex, but there already is a tool out there for getting past that: https://github.com/Ciastex/UniDec (you can also use this tool to recover site passwords)

I will run through the sample key Martin posted up because even with UniDec it took me a while to figure out the passphrase.

From the Store.ini file we get:

Pass=_uYIiwEW/JZFazUCvOd/TWbCmvzSdwu9aCmtFaVCSH51nomzGuvWAEAkti3EvnB+M0mTy6Z9CFma3nqAWO5IH1olwmyLYcJLoCOIUDLgd3/rA3LiiF4PUtT5saieLNBZZKHsJXOkzltW6/n4QhOJx/l345tmz079mEljhaN+2Dao=

Use UniDec with the WSFTP12 plugin:

UniDec.exe wsftp12 dec _uYIiwEW/JZFazUCvOd/TWbCmvzSdwu9aCmtFaVCSH51nomzGuvWAEAkti3EvnB+M0mTy6Z9CFma3nqAWO5IH1olwmyLYcJLoCOIUDLgd3/rA3LiiF4PUtT5saieLNBZZKHsJXOkzltW6/n4QhOJx/l345tmz079mEljhaN+2Dao=

Unidec returns:

tgNEu9GS3zoj5aMqnzzLb7RuYxqyO8kaN0bVlndXXpTTT52DHcKdQIIYWAVN0ZIkPg3BpvTR2EstOGd+NOOf0Q== 0M0JDARAMFqcFpgfm76MAUSpWVurQfKNvKcRCg=

Note the space after == Only the first part of the returned string is your passphrase. Remaining characters are some kind of padding that we can ignore. Now we have all of the information needed to decrypt the PKCS#8 private key file.

openssl rsa -in Pri26BD.tmp -out decrypted.key
Enter pass phrase for Pri26BD.tmp: tgNEu9GS3zoj5aMqnzzLb7RuYxqyO8kaN0bVlndXXpTTT52DHcKdQIIYWAVN0ZIkPg3BpvTR2EstOGd+NOOf0Q== 
writing RSA key

And here is the final key:

Hope this helps someone out.

Is there anywhere to grab the exe's that you know of? I have never compiled anything in my life but i need this tool :-) — l0ckm4, Feb 25 '21 at 12:15

Martin Prikryl · Answer 2 · 2014-12-16T13:20:32.160

The passphrase seems to be stored in the same folder as the key in Store.ini file:

[____Item____0]
____ItemName____=mysite
PublicKey=C:\Users\martin\AppData\Roaming\Ipswitch\WS_FTP\SSH\ClientKeyStore\Pub262F.tmp
Pass=_uYIiwEW/JZFazUCvOd/TWbCmvzSdwu9aCmtFaVCSH51nomzGuvWAEAkti3EvnB+M0mTy6Z9CFma3nqAWO5IH1olwmyLYcJLoCOIUDLgd3/rA3LiiF4PUtT5saieLNBZZKHsJXOkzltW6/n4QhOJx/l345tmz079mEljhaN+2Dao=
PrivateKey=C:\Users\martin\AppData\Roaming\Ipswitch\WS_FTP\SSH\ClientKeyStore\Pri26BD.tmp

It seems like base-64 encoded binary passphrase. Though I still was not able to decrypt the key.

I decoded the binary passphrase (using PHP base64_decode) and saved it to a file phrase. It has nice round 128 bytes, that looks good.

Then I run:

openssl rsa -in Pri26BD.tmp -out key.decrypted -passin file:phrase

and got:

unable to load Private Key
139830511232840:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:596:
139830511232840:error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error:p12_decr.c:104:
139830511232840:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:130:
139830511232840:error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib:pem_pkey.c:132:

So this is actually not a final answer, but at least a step forward. Maybe someone else will be able to build on it.

The test key (to make the post complete):

Where is the encryption "password" for auto-encrypted WS_FTP SSH private SSH keys?

2 Answers2