PMP-Decrypter
This is a tool to decrypt the encrypted password strings in Patch My PC settings.xml files.
In my case it was the SMTP password, but as there is only one encryption and decryption function in the tool, it should work for all of them.
Patch My PC saves the values for the crypto functions in registry keys under:
HKLM\Software\Patch My PC Publishing Service
Data1 = Key
Data2 = Salt
Data3 = IV
I honestly dunno if this is also true for the latest latest latest version, but the one I stumbled upon seems to be from 04/2023 so pretty new.
The ACLs on those keys are lax, so can be read by everyone.
The settings file resides in the application's main folder and is called Settings.xml.
Usage
The tool first trys to fetch those key values automagically for you.
If not found, you still have the option to specify them manually.
PMP-Decrypter.exe <encryptedText> [privateKey] [saltKey] [ivKey]
Build
I used Visual Studio 2017, .Net Framework 4 and release mode.
If you dare, you can use the precompiled version.
Countermeasures
Honestly speaking: If a company which wants to connect to such critical assets takes security like this, I would not recommend using this at all.
You could restrict access to the reg keys, so that not everyone is able to read them.
If you operate it, where ever possible use low privileged, dedicated accounts. Sending mails with your DA account is not the best idea you might have.