catalyst256 / netscaler-cookie-decryptor Goto Github PK

Steps to reproduce

1. Run $ ./nsc-cookie-decrypt-org.js NSC_xxx.fybnqmf.dpn=ffffffffc3a08b245525d5f4f58455e445a4a423660

Current behaviour (bug)

realName : www.example.com
realIP : 63.87.106.203
realPort : 80

Expected behaviour (correct)

realName : www.example.com
realIP : 192.168.149.53
realPort : 80

Other comment (optional)

Running with python version generates correct output.

./nsccookiedecrypt.py NSC_xxx.fybnqmf.dpn=ffffffffc3a08b245525d5f4f58455e445a4a423660
vServer Name=www.example.com
vServer IP=192.168.149.53
vServer Port=80

Digging futher into this it appears to be be an issue with server ip addresses that are larger than 2^31

Looks like adding a >>> 0 will convert the negative result back to the correct positive number, without affecting the result for numbers that do not result in a negative result.

So

const decodedIP = (serverIP ^ ipKey >>> 0)

I'm testing this change and it appears to be working well so I'll submit a Pull Request shortly.

Hello there,
I've translated the decryptor to ruby and I see you have ported the script to more than one language. If you like, I would PR ruby to this repo as well (check here) to have multiple languages at the same place
Note: There is an enhancement in the regex in my version that supports the punctuation marks as I've experienced a cookie with ! character recently.