Tibco README corrected for markdown.

Author: tsluyter

Tibco/README.md

@@ -1,11 +1,13 @@
-== Introduction
+# Tibco password decryption exploit
+
+## Introduction
 
 During a pen-test of an internally developed application, I discovered that the engineers in question had re-used a commercial Java library for password obfuscation. 
 
 While their application was not part of a Tibco stack, nor did it use Tibco, they did make use of Tibco's "*ObfuscationEngine*". On Tibco systems, this tool is used to obfuscate (and sometimes encrypt) passwords for safe storage in configuration files. 
 
 
-== Background ==
+## Background
 
 Tibco's documentation states that there are three modes of operation for this ObfuscationEngine tooling:
 
@@ -26,7 +28,7 @@ and
 Secrets obfuscated using the Tibco fixed key can be recognized by the fact that they start with the characters #!. For example: "#!oe2FVz/rcjokKW2hIDGE7nSX1U+VKRjA".
 
 
-== Issues ==
+## Issues
 
 The first statement does not make clear the risks that are involved, while the second statement is blatantly incorrect.
 
@@ -48,7 +50,7 @@ By analyzing this JAR file, I recovered the fixed key. Using that I wrote a smal
 The code is provided here in this repository as “decrypt.java”.
 
 
-== Impact ==
+## Impact
 
 Regardless of country, customer, network or version of Tibco, any secret that was obfuscated with Tibco's ObfuscationEngine can be decrypted using my Java tool. It does **not** require access to Tibco software or libraries. 
 
@@ -57,7 +59,7 @@ All you need are exfiltrated secret strings that start with the characters #!.
 This is not going to be fixed by Tibco, this is a design decision also used for backwards compatibility in their software.
 
 
-== Instructions ==
+## Instructions
 
 Compile with: 
 
@@ -72,7 +74,7 @@ Examples of running, with secrets retrieved from websites and forums:
 		tibco
 
 
-== Outcome ==
+## Outcome
 
 I have shared my findings internally with my client. I have advised them to A) stop including Tibco's copyrighted classes and libraries into their own Java applications, B) replace all secrets encrypted using this method, as they should be considered compromised. 
 
@@ -89,3 +91,8 @@ The text now reads:
 "*The fixed key is compatible with earlier versions of TIBCO Runtime Agent but should not be treated as secure. A machine key or custom encryption key should be used whenever possible.*"
 
 
+## CVE / Vulnerability information
+
+No CVE was awarded as the vendor did not recognize this as a vulnerability. This is intended functionality, which "works as designed".
+
+