Decrypting Solar-PuTTY sessions

Solar-PuTTY (by SolarWinds) is an SSH/RDP connection manager that stores sessions, including their credentials, in a sessions-backup.dat file. The problem is how it stores them: the file is a blob encrypted with AES, but the key is a user-chosen password derived with a weak scheme (PBKDF with very few iterations). That makes it a perfect target for an offline dictionary attack: if we find that .dat on a compromised machine, we can break the password locally with no attempt limit.

Here the file shows up in a backups directory on the host:

ls /opt/backups/Solar-PuTTY/      # sessions-backup.dat

It's exfiltrated to the attacking machine and attacked with a SolarPuttyCracker-style tool, which tries each wordlist entry as the decryption password until the AES yields valid JSON:

python3 SolarPuttyCracker.py -w rockyou.txt -o output.txt sessions-backup.dat

On success, output.txt holds the sessions JSON in clear: name, IP, port and, crucially, the Credentials block with Username and Password. On this box that hands over the root password directly, and a simple su root completes the escalation by credential reuse.

Why. A convenience tool stores high-value secrets (admin credentials) with encryption that's reversible by brute force. The .dat looks harmless (binary data), but its contents are gold. It connects to offline cracking: the low derivation cost is what makes the attack viable.

Defence. Don't leave session-manager backups on the host; if used, protect them with a strong master password and restrict read access; prefer key/certificate authentication over stored passwords.