Waraxe IT Security Portal

Nial · Advanced user

Hi all, I know phpbb 3.0 is a rock, but is there a way to breach it from the admin panel? Like fake template, or security modification etc?

Another question about salt : i get the backup of the user table, and it seems the salt is crypted like :
password : $H$9t6dsS0mPW7Kz8MTxrGG8hKWRn6Qbf.
salt : dfe084853af62444

What is the algo of the salt?

waraxe · Site admin

PhpBB hashing algorithm is flexible and can be in some degree different from installation to installation, but main feature is using of THOUSANDS md5 hashing rounds for just one hash. It's comparable to Unix-style MD5 hash and it means, that bruteforce attack is PAINFULLY SLOW. I can crack simple md5 hashes on my PC with speed > 6 000 000 passwords per second, phpBB3 algorithm's speed is ~2800 passwords per second (on Conroe 6600 Processor). And of course no rainbow tables because of salting. So basically phpBB hashes are extremely hard to crack Wink

Frigo · Regular user

Salted hashes are bad enough, but grilled & salted ones are nightmare.

Though a dictionary attack can be successful to some degree, especially if it is ordered by the occurrence of passwords, but expect a much slower attack, and much lower crack rates.

Nial · Advanced user

So if i cannot crack the pass with my admin account, is there something else i can do to get my shell on the server?
And another question, if i reset the password in the salt row of a forum like phpbb or ipb etc..., the new password entered by the user will be in simple md5?

theparadox · Regular user