Waraxe Forums

jmgredskins · Regular user

So i payed a guy to get me a password but he only gave me a "salted hash", I have been trying to crack the hash for hours but I have no idea what im doing. If anyone here can help me out I would appreciate it.

a5c6ffeae69640058b098f699dbb043a

Chb · Valuable expert

Where did you get it from? (Software etc.)

jmgredskins · Regular user

An active perl exploit.

Chb · Valuable expert

Err, I meant the software using the password (e.g. bulletin boards, administration panels, etc.)

jmgredskins · Regular user

Oh haha, its a Vbulletin Forum

board.rapbasement.com

jmgredskins · Regular user

anyone?

I will pay 200 dollars to anyone who can crack this.

vince213333 · Advanced user

Finding the password from a salted hash without the salt is extremely time-consuming. The only option there is is to try each possible combination of 3 random characters that can act as a salt in vBulletin. A dictionary attack with a tiny dictionary might take an hour or more (very rough estimation) so imagine how hard it would be if the password is something like m1pa$$w0rd.

jmgredskins · Regular user

ok ill have to look into that thanks.

also i have been messing around with programs like hashcat and password pro. i am doing a brute force attack, is it possible to get it that way or am i wasting my time.

vince213333 · Advanced user

Passwordspro isn't any good here unless you import the same hash with all possible salts.

Hashcat was originally designed for situations like this. It comes with a vBulletin.salt file that contains all possible vBulletin salts. You can put your hash in the hash list and use that salt file as a salt list. Then it'll try the hash with each salt in the salt file.

jmgredskins · Regular user

Nice, Just downloaded it. I don't have a wordlist.. Does "charset" mean hash?

vince213333 · Advanced user

I suspect you downloaded the command line interface only. There's a GUI available too here.

Just search on google for some wordlists or look in the wordlists section on this forum.

Charset is the character set you define for a bruteforce attack. A charset contains all characters you want to try for a bruteforce attack.

jmgredskins · Regular user

so basically i just put like every letter and every number

vince213333 · Advanced user

the creators of hashcat already did that for you, but if you want to use passwordspro, then indeed you have to do that or extract all the salts from the vBulletin.salt file of hashcat.

jmgredskins · Regular user

ok thanks for you help, i have one more question.

in this case for hashcat would i use

MD5($salt.$pass)

MD5($pass.$salt)

vince213333 · Advanced user

The password comes from a vBulletin database. vBulletin uses this encryption algo:

md5(md5(pass).salt)

Hashcat provides this as:

md5(md5($pass).$salt)