Waraxe IT Security Portal

Zax0mA · Beginner

Here is the dump data from IPB.
Does IPB actually use a salt? Couldn't find any salt info in the mysql table...

Here is the hash, please tell me where to find the salt, if it exists.
"93ba65e438b671ab3bc030828f909a60".

Would be nice to see it cracked, can give you root servers for it.

Regards,

BoboTiG · Advanced user

Zax0mA · Beginner

"2.3.6 ".
Where in the DB can I find the has for the user?

I exploited another software using the same database via SQLi and got the admin info via

"SELECT id, member_login_key, members_display_name FROM dbname.inv_members WHERE id = 3 "

3 is the id of the admin.

Any suggestions?

Thanks for your help.

renaker · Active user

In "Invision Power Board <= 2.3.5 Remote SQL Injection Exploit" by waraxe, the hash and salt are retrieved like this:
(php snippets)

hash:

$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";

salt:

$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";

...so in short, they're kept in the members_converge table, the hash field is "converge_pass_hash" and the salt field is "converge_pass_salt"