Introducing Orchestrator decryption tool

This blog post demonstrates that System Center Orchestrator stores encrypted variables in its SQL database and shows step-by-step how an attacker or administrator with database access can load the ORCHESTRATOR_SYM_KEY and run decryptbykey to recover plaintext secrets; it also references a Fox-IT script and a Metasploit post module that automate extracting and decrypting these stored credentials.