THREAT OPS › Threat News › Cleartext Credential Recovery in ServiceNow
Cleartext Credential Recovery in ServiceNow
<p class="wp-block-paragraph"><em><strong>TL;DR:</strong> This post explores using ServiceNow script includes to create a cleartext credential retrieval mechanism valid for any discovery credential type and LDAP credential records.</em></p>
<h2 class="wp-block-heading" id="h-introduction">Introduction</h2>
<p class="wp-block-paragraph">ServiceNow is a cloud IT service management platform (IT
MITRE ATT&CK techniques
Indicators of compromise
- https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/url
- https://www.servicenow.com/docs/r/platform-security/connections-and-credentials/c_CyberArkCredStorageIntegrate.htmlurl
- https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/#attack1url
- https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/#attack2url
- https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/#attack3url
- https://www.servicenow.com/docs/r/api-reference/scripts/c_ScriptIncludes.htmlurl
- https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/#attack4url
- https://www.servicenow.com/docs/r/zurich/platform-security/platform-encryption/password-2way-encrypted-fields.htmlurl
- https://www.servicenow.com/docs/r/platform-security/connections-and-credentials/credentials-getting-started.htmlurl