Waraxe Forums

newbie2 · Beginner

Hi,

I have admin access to a forum and wanted to see if I could use tools to discover the password of a user.

I have access to the database ( mySQL 5.0).

I have a test user that I have created to test various tools but still cant get them to crack a password.

The details are:

Forum is IPB version 2.1.5
Database is SQL 5.0.45

From the database I can find:

Username
Member_login_key: 3a2c3cccdd8ea37ed722c261fa321f20
converge_pass_hash: 8bcbb7476f3a4fe395c119b0acaeb81b
Converge_pass_salt: "[7~Y

Can anyone tell me what tool to use, and how, to gather the password given the above information.

Thanks for taking the time to read my newbie request - im sure there are a lot of Rolling Eyes

taking place from some of the more knowledgable right now.

newbie2 · Beginner

Update:

Ive now used md5this and the converge_pass_hash with the salt and recovered a simple plain text password for a test account I set up.

Is there a way I can combine the md5this operation with a bruteforce style attack rather than relying on a simple wordlist?

Ill continue researching and post here with any info which may help people help me.

Thanks.

waraxe · Site admin

I was using PasswordsPro and got this salted hash cracked:

bollock

As it is loweralpha 7 chars, then bruteforce is possible, but i was successful with worldlists.

newbie2 · Beginner

Yup - thats the test user, sorry - I didnt make it clear in my example.

I just figured out how to use password pro with the IPB compatible module - its not that much of a steep learning curve after all.

Now I am trying it on a user that I have no idea on the password length or characters.

Im just using loweralpha again, and a max of 9 characters. The 95 day wait is a bit of a downer. Shocked

Anything that can be done to speed this up - other than use a faster PC Laughing

Heres the MD5 and salt for a non-test user:

540e099fb47950ebadf8a138a71b31f5
CqkXW

Thanks again for your help.

waraxe · Site admin

As hash is salted, then rainbow tables are useless. Only 2 ways to crack:

1. wordlists, if password is weak
2. bruteforce - faster PC, multiple cores, distributed cracking - they all help, but no miracles here: if password is good, then it's uncrackable Smile

newbie2 · Beginner

Hi, thanks for the info.

I have now had success with a few accounts using both brute force and wordlists, and have now begun looking at accessing a specific area of a coppermine gallery that is attached to a forum.

No harm done along the way either - no malicious changes made to any sites Ive accessed, just attempted this out of morbid curiosity more than anything.

Thanks again. Now if I can only find some info on coppermine hacks. Very Happy