 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 159
 Members: 0
 Total: 159
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
never saw such a hash before! HELP! |
|
 Posted: Sat Nov 24, 2007 8:13 pm |
 |
|
| iiDo |
| Regular user |
 |
|
| Joined: Nov 24, 2007 |
| Posts: 19 |
|
|
|
 |
|
 |
|
user_password: "$H$9m51pcH2EndaSm8rIAwWoF2YjAgpof0"
has anyone a idea how to crack that hash?
thx people! |
|
|
|
|
|
Re: never saw such a hash before! HELP! |
|
| Posted: Sat Nov 24, 2007 9:01 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| iiDo wrote: | user_password: "$H$9m51pcH2EndaSm8rIAwWoF2YjAgpof0"
has anyone a idea how to crack that hash?
thx people! |
Something, I found from phpbb dev forum:
http://www.phpbb.com/community/viewtopic.php?f=71&t=585387
| Code: |
by ameeck on Tue Oct 16, 2007 3:37 pm
Yeah..I got this hash:
$H$7rssbSMgLmkpWoRKZMdk6ERZ4Fhrkq1
|
So gimme some time, i will find answer soon 
... more info ...
| Code: |
phpBB3 Release Candidate 7 (RC7) released
Postby Acyd Burn on Mon Oct 15, 2007 12:08 am
Hello,
We are very pleased to announce the availability of the phpBB3 RC7 package, the "We are sorry and love our support team" edition. This release fixes some critical issues which arised with the recently released Release Candidate 6, basically fixing some bbcode problems as well as missing form tokens. On the downloads page we provide two update packages this time, one for going from RC5 to RC7 and one for going from RC6 to RC7.
This release is mostly the outcome of an external security audit performed by SektionEins. All items tagged as [Sec] were found by the company doing the audit and revealed some fundamental problems we were able to fix. We are proud that the audit revealed no sql injection vulnerability or critical command execution vulnerabilities.
...
[Sec] New password hashing mechanism for storing passwords (#i42)
|
So this means end of rainbow cracking against phpbb password hashes and needs new algorithm to password crackers I guess |
|
|
|
|
|
|
|
|
| Posted: Sun Nov 25, 2007 4:43 am |
|
|
| iiDo |
| Regular user |
|
|
| Joined: Nov 24, 2007 |
| Posts: 19 |
|
|
|
|
|
|
|
ok and where is the algorithm of such a hash saved and how to crack i then?
i think this information could be useful for anyone here!!
thx! |
|
|
|
|
| Posted: Sun Nov 25, 2007 2:45 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| iiDo wrote: | ok and where is the algorithm of such a hash saved and how to crack i then?
i think this information could be useful for anyone here!!
thx! |
This is interesting situation. Because noone else seems to be noticed this huge password storing algo change in phpbb. And when phpbb will go from RC7 to phpbb 3.0 and many websites will upgrade, then suddenly lots of people will realize - oops, we dont have ANY password cracking programs, able to crack those phpbb hashes
Sure, it is easy to write simple php script for bruteforce or wordlist cracking, but it will lack performance. So what we need, is cracking program written in C or Delphi |
|
|
|
|
|
|
|
|
| Posted: Sun Nov 25, 2007 8:18 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
More info about phpbb 3.0.RC7 hashing algo.
It's f***ing overkill:
| Code: |
if (PHP_VERSION >= 5)
{
$hash = md5($salt . $password, true);
do
{
$hash = md5($hash . $password, true);
}
while (--$count);
}
else
{
$hash = pack('H*', md5($salt . $password));
do
{
$hash = pack('H*', md5($hash . $password));
}
while (--$count);
}
|
... where default count seems to be 2048 
So casual md5 bruteforce and wordlist cracking will be > 2000 times slower |
|
|
|
|
| Posted: Sun Nov 25, 2007 10:15 pm |
|
|
| iiDo |
| Regular user |
|
|
| Joined: Nov 24, 2007 |
| Posts: 19 |
|
|
|
|
|
|
|
i wont brute it i tryin to find a why to get the algorithm and simple "compare" it and then i will get the md5
i know that there is a way! |
|
|
|
|
www.waraxe.us Forum Index -> Hash related information
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
