Cleartext Credential Recovery in ServiceNow

[carlospolop]

Blog URL

https://specterops.io/blog/2026/08/27/cleartext-credential-recovery-servicenow

Blog Title

Cleartext Credential Recovery in ServiceNow

Blog high summary

ServiceNow decrypts Discovery credentials during credential tests. A privileged user can modify CredentialTestAjax so /xmlhttp.do returns _decryptCredentialData() output, exposing passwords, SSH keys, AWS keys, and Entra ID secrets. A second path abuses Password2.getDecryptedValue() in a custom script include to dump LDAP bind passwords. Exploitation requires roles such as discovery_admin, agent_admin, or script_include_admin. Two GitHub PoCs

are provided; no CVE is mentioned.

PR changes

• src/network-services-pentesting/pentesting-web/servicenow.md: Added or revised coverage of Post-exploitation: cleartext credential recovery; Discovery credentials via CredentialTestAjax; LDAP Password2 fields.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 83de05b7af1794405c5760ddac568576fc1fbd8e

Documents two privileged ServiceNow post-exploitation paths that expose secrets at server-side decryption boundaries: Discovery credentials through a modifiable Script Include and LDAP Password2 values through a client-callable include. It records role and record-access prerequisites, unsupported vault configurations, and authentication limitations.

• The original research and both PoCs substantiate the credential stores, decryption mechanisms, prerequisites, limitations, and cleanup behavior.
• The current book has no equivalent ServiceNow credential-recovery coverage; the existing ServiceNow page is the canonical destination.
• Removed the unsupported defensive-telemetry subsection while preserving the source-backed offensive material and code bodies.
• PR When It Snows It Pours – Anatomy of a ServiceNow Red Team #2873 changes the same page but covers distinct ServiceNow foothold, escalation, and persistence mechanisms.
• The base changed after review; source/coverage and candidate validation need a fresh review. No repairs or merge signal were published.

Editorial repairs:

• src/network-services-pentesting/pentesting-web/servicenow.md: Removed source-unsubstantiated detection guidance while retaining the verified Discovery and LDAP credential-recovery documentation, prerequisites, limitations, examples, and references.

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: cb90d8f1b320b3520af7725a5b96ae59a4de19ae

Documents two privileged ServiceNow credential-recovery mechanisms: exposing Discovery secrets at the credential-test decryption boundary and decrypting LDAP Password2 fields through a client-callable Script Include. It records the tested role requirements, authentication limitations, unsupported external-vault case, and accompanying tooling.

• The two credential-recovery mechanisms are source-supported, reusable, and absent from the current book.
• The existing ServiceNow page is the canonical product-specific destination; no new page or navigation change is needed.
• PR When It Snows It Pours – Anatomy of a ServiceNow Red Team #2873 was checked in full. Its MID-server credential recovery uses a different execution boundary and does not cover the proposed Script Include or LDAP Password2 mechanisms.
• Removed unsupported generic detection guidance and corrected an unsubstantiated characterization of the PoC repository.

Editorial repairs:

• src/network-services-pentesting/pentesting-web/servicenow.md: Removed unsupported detection guidance and changed the PoC description from “maintained” to the source-supported “accompanying,” while preserving both credential-recovery mechanisms and their constraints.

[carlospolop]

merge

[livingthedream5]

STOP

…

On Sun, Oct 11, 2026, 12:50 PM SirBroccoli ***@***.***> wrote: *carlospolop* left a comment (HackTricks-wiki/hacktricks#2855) <#2855 (comment)> merge — Reply to this email directly, view it on GitHub <#2855?email_source=notifications&email_token=APD3LA43273LWJAZMP4PMLT5TPQANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGMZZGY22M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-6113033965>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APD3LA2ZKD3LBL5RGEHIG635TPQANAVCNFSNUABFKJSXA33TNF2G64TZHMZDOOJZGA4DMOBZHNEXG43VMU5TKNBVGMYDOOBUGQZKC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/APD3LAY3CUHAQN4PFHLIYPL5TPQANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGMZZGY22M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/APD3LA3TN762L4HPONSBQJD5TPQANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGMZZGY22M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: cb90d8f1b320b3520af7725a5b96ae59a4de19ae

Documents two privileged ServiceNow credential-recovery mechanisms: exposing Discovery secrets at the CredentialTestAjax decryption boundary and decrypting LDAP Password2 fields through a client-callable Script Include. It records tested role, authentication, credential-type, and external-vault constraints.

• The source article and both referenced PoCs support the mechanisms, prerequisites, limitations, and cleanup behavior described.
• Current base coverage discusses anonymous ServiceNow data exposure but not privileged server-side credential recovery.
• Pending PR When It Snows It Pours – Anatomy of a ServiceNow Red Team #2873 covers distinct MID-server credential retrieval rather than these tenant-side Script Include mechanisms.
• The existing ServiceNow page is the canonical destination; citations, references, banners, headings, and code fences are consistent. No editorial repair was needed.

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: cb90d8f1b320b3520af7725a5b96ae59a4de19ae

Adds ServiceNow post-exploitation coverage for recovering locally stored Discovery secrets at the credential-test decryption boundary and decrypting LDAP Password2 fields through privileged Script Includes. It documents tested role requirements, authentication limitations, unsupported external-vault configurations, and cleanup behavior.

• Both credential-recovery mechanisms are reusable, technically detailed, source-supported, and absent from the current base book.
• The SpecterOps research and accompanying PoCs support the described decryption boundaries, tested permissions, compatibility limits, and restoration or deletion behavior.
• The existing ServiceNow page is the canonical product-specific destination and already covers earlier reconnaissance and data-exposure techniques.
• Pending PR When It Snows It Pours – Anatomy of a ServiceNow Red Team #2873 modifies the same page but documents distinct role-escalation and MID-server workflows; its credential retrieval occurs on the MID server rather than through the two submitted Script Include mechanisms.
• Citations, references, banners, headings, and code fences are consistent and complete. No editorial repair was necessary.