Reversing F5 Service Password Encryption

F5 load balancers are usually deployed as active and standby pairs that exchange configurations, including encrypted service account passwords such as LDAP bind credentials. This talk examined how those values are protected. Each stored password uses a dollar-M prefixed format, and its encryption depends on a master key that is itself wrapped by a unit key. The unit key sits in EPROM on physical hardware and on the filesystem for virtual appliances.

The speaker pointed out that an uppercase K option on the key management command is barely documented, yet it exposes a base64 key when used. With that key and the encrypted string, decryption is simple: strip the prefix, base64 decode the value, and run AES-128 in ECB mode. A live demo used a Python script to recover a password from a master key taken from a device, and the unit key could be used to derive the master key as well. In the Q&A, the speaker said FIPS-mode systems had not been tested, but expected the same synchronization dependency to make the approach workable there.

The main takeaway is that if an F5 is compromised, even encrypted service credentials should be treated as exposed, because everything needed to decrypt them is on the box. Responders handling an F5 incident should rotate the service account passwords stored on it.