The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes
Summary
An in-depth reverse-engineering analysis of IBM i's QSYRUPWD API reveals how privileged access can expose password-related material. The piece documents a multi-stage CIPHER workflow that embeds usernames, DES-derived values, intermediate hashes, and NT hashes within the API output, and demonstrates practical methods to reconstruct credentials offline. It also covers debugging techniques (SST, STRTRC), observed data structures, and potential mitigations for organizations using IBM i.