I've been sent a series of files that I need access to, along with a password. Unfortunately, I haven't been told how the files were encrypted.
I can see that the encryption process has added the extension ".XML" to each of the encrypted files. The files then have the following XML header (line breaks added for readability, hashes cut out in case they turn out to be secure info), a line break, and then what I presume to be the actual encrypted file contents.
<?xml version="1.0" encoding="UTF-16"?>
<!--GETRSFileHeaderSize=0x00000BF2-->
<GETEncryptedDataFile version="x.x.x">
<FileInformation>
<filename>
(Windows File Path was here)
</filename>
<created>Tue, 18 Nov 2014 15:56:21 UT-0000</created>
</FileInformation>
<AlignmentLength>512</AlignmentLength>
<WrappedKeys iv="value here" hash="value here">
<Certificate hashmethod="kdf2">
<wrappedkey method="rc4">very long value here</wrappedkey>
</Certificate>
<UPC hashmethod="kdf2"><wrappedkey>value here</wrappedkey>
</UPC>
</WrappedKeys>
I think this (plus the password) should be everything I need to decrypt the file, but I'm really struggling at the "how" part.
I have tried the following to drop the third (encrypted) line of the file into openssl to decrypt, but it gives the response "bad magic number".
sed -n '3p' filename | openssl enc -rc4 -d
I guess I need to use the hashes and keys provided in the XML header, but that's where I'm stuck as I've not done a lot of encryption stuff.