Waraxe IT Security Portal
Login or Register
November 5, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 69
Members: 0
Total: 69
Full disclosure
4 vulnerabilities in ibmsecurity
32 vulnerabilities in IBM Security Verify Access
xlibre Xnest security advisory & bugfix releases
APPLE-SA-10-29-2024-1 Safari 18.1
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600)
SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333)
APPLE-SA-10-28-2024-8 visionOS 2.1
APPLE-SA-10-28-2024-7 tvOS 18.1
APPLE-SA-10-28-2024-6 watchOS 11.1
APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1
APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1
APPLE-SA-10-28-2024-3 macOS Sequoia 15.1
APPLE-SA-10-28-2024-2 iOS 17.7.1 and iPadOS 17.7.1
APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1
Open Redirect / Reflected XSS - booked-schedulerv2.8.5
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Hash related information -> never saw such a hash before! HELP!
Post new topicReply to topic View previous topic :: View next topic
never saw such a hash before! HELP!
PostPosted: Sat Nov 24, 2007 8:13 pm Reply with quote
iiDo
Regular user
Regular user
Joined: Nov 24, 2007
Posts: 19




user_password: "$H$9m51pcH2EndaSm8rIAwWoF2YjAgpof0"

has anyone a idea how to crack that hash?

thx people!
View user's profile Send private message
Re: never saw such a hash before! HELP!
PostPosted: Sat Nov 24, 2007 9:01 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




iiDo wrote:
user_password: "$H$9m51pcH2EndaSm8rIAwWoF2YjAgpof0"

has anyone a idea how to crack that hash?

thx people!


Something, I found from phpbb dev forum:

http://www.phpbb.com/community/viewtopic.php?f=71&t=585387

Code:

by ameeck on Tue Oct 16, 2007 3:37 pm

Yeah..I got this hash:
$H$7rssbSMgLmkpWoRKZMdk6ERZ4Fhrkq1


So gimme some time, i will find answer soon Smile

... more info ...

Code:

phpBB3 Release Candidate 7 (RC7) released

Postby Acyd Burn on Mon Oct 15, 2007 12:08 am

Hello,

We are very pleased to announce the availability of the phpBB3 RC7 package, the "We are sorry and love our support team" edition. This release fixes some critical issues which arised with the recently released Release Candidate 6, basically fixing some bbcode problems as well as missing form tokens. On the downloads page we provide two update packages this time, one for going from RC5 to RC7 and one for going from RC6 to RC7.

This release is mostly the outcome of an external security audit performed by SektionEins. All items tagged as [Sec] were found by the company doing the audit and revealed some fundamental problems we were able to fix. We are proud that the audit revealed no sql injection vulnerability or critical command execution vulnerabilities.

...

[Sec] New password hashing mechanism for storing passwords (#i42)


So this means end of rainbow cracking against phpbb password hashes and needs new algorithm to password crackers I guess Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Nov 25, 2007 4:43 am Reply with quote
iiDo
Regular user
Regular user
Joined: Nov 24, 2007
Posts: 19




ok and where is the algorithm of such a hash saved and how to crack i then?

i think this information could be useful for anyone here!!

thx!
View user's profile Send private message
PostPosted: Sun Nov 25, 2007 2:45 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




iiDo wrote:
ok and where is the algorithm of such a hash saved and how to crack i then?

i think this information could be useful for anyone here!!

thx!


This is interesting situation. Because noone else seems to be noticed this huge password storing algo change in phpbb. And when phpbb will go from RC7 to phpbb 3.0 and many websites will upgrade, then suddenly lots of people will realize - oops, we dont have ANY password cracking programs, able to crack those phpbb hashes Smile
Sure, it is easy to write simple php script for bruteforce or wordlist cracking, but it will lack performance. So what we need, is cracking program written in C or Delphi Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Nov 25, 2007 8:18 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




More info about phpbb 3.0.RC7 hashing algo.

It's f***ing overkill:

Code:

if (PHP_VERSION >= 5)
{
$hash = md5($salt . $password, true);
do
{
$hash = md5($hash . $password, true);
}
while (--$count);
}
else
{
$hash = pack('H*', md5($salt . $password));
do
{
$hash = pack('H*', md5($hash . $password));
}
while (--$count);
}



... where default count seems to be 2048 Exclamation
So casual md5 bruteforce and wordlist cracking will be > 2000 times slower Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Nov 25, 2007 10:15 pm Reply with quote
iiDo
Regular user
Regular user
Joined: Nov 24, 2007
Posts: 19




i wont brute it i tryin to find a why to get the algorithm and simple "compare" it and then i will get the md5
i know that there is a way!
View user's profile Send private message
never saw such a hash before! HELP!
www.waraxe.us Forum Index -> Hash related information
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB © 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.034 Seconds