java ee - Weblogic 12c encryption algorithme for credentials -

in weblogic can define users , groups , can assign roles them, question (probably file) , how weblogic persist these important data. seems should encrypted, algorithm , other encryption settings?

see https://blog.netspi.com/decrypting-weblogic-passwords/

or directly project: https://github.com/netspi/weblogicpassworddecryptor

the relevant snippet, in case urls rot away, is:

public static string decryptaes(string serializedsystemini, string ciphertext) throws nosuchalgorithmexception, invalidkeyspecexception, nosuchpaddingexception, invalidalgorithmparameterexception, invalidkeyexception, badpaddingexception, illegalblocksizeexception, ioexception {      byte[] encryptedpassword1 = new base64decoder().decodebuffer(ciphertext);     byte[] salt = null;     byte[] encryptionkey = null;      string key = "0xccb97558940b82637c8bec3c770f86fa3a391a56"; //weblogic default key      char password[] = new char[key.length()];      key.getchars(0, password.length, password, 0);      fileinputstream = new fileinputstream(serializedsystemini);     try {         salt = readbytes(is);          int version = is.read();         if (version != -1) {             encryptionkey = readbytes(is);             if (version >= 2) {                 encryptionkey = readbytes(is);             }         }     } catch (ioexception e) {      }      secretkeyfactory keyfactory = secretkeyfactory.getinstance("pbewithshaand128bitrc2-cbc");      pbekeyspec pbekeyspec = new pbekeyspec(password, salt, 5);      secretkey secretkey = keyfactory.generatesecret(pbekeyspec);      pbeparameterspec pbeparameterspec = new pbeparameterspec(salt, 0);      cipher cipher = cipher.getinstance("pbewithshaand128bitrc2-cbc");     cipher.init(cipher.decrypt_mode, secretkey, pbeparameterspec);     secretkeyspec secretkeyspec = new secretkeyspec(cipher.dofinal(encryptionkey), "aes");      byte[] iv = new byte[16];     system.arraycopy(encryptedpassword1, 0, iv, 0, 16);     byte[] encryptedpassword2 = new byte[16];     system.arraycopy(encryptedpassword1, 16, encryptedpassword2, 0, 16);      ivparameterspec ivparameterspec = new ivparameterspec(iv);     cipher outcipher = cipher.getinstance("aes/cbc/pkcs5padding");     outcipher.init(cipher.decrypt_mode, secretkeyspec, ivparameterspec);      byte[] cleartext = outcipher.dofinal(encryptedpassword2);      return new string(cleartext, "utf-8");  }