Waraxe IT Security Portal

Vixje · Active user

Hi,

I have a db of a ipb 2.0+ forum. This forum uses salted hashes. Are these still "crackable" ?

For example i will give you one with a easy password:

INSERT INTO ibf_members_converge (converge_id, converge_email, converge_joined, converge_pass_hash, converge_pass_salt) VALUES('60882','sum@mailaddress.com','1139136008','9c584e88e8db016b867978c4c226c442','<`!G`');

How to un-salt it?

Indiction · Regular user

Yes, you can crack salted hashes but its much harder.

First you must cryptanalyze the MD5 hash and determine its reverse. Now bear in mind that a salted md5 function is as follows:

md5(x ? c)

where x = the cleartext, c = the salt and ? = the mathematical operation.
Say this is equal to the value 00000000000000000000000000000000 (just for kicks), and we add the salt.

md5(x + c) = 00000000000000000000000000000000

Now what we must do is solve for x.

md5^-1(md5(x+c)) = md5^-1(00000000000000000000000000000000)
x+c = md5^-1(00000000000000000000000000000000)
x = md5^-1(00000000000000000000000000000000) - c

Where md5^-1 = a reverse of the message digest 5 algorithm.
I believe this is how you retrieve the cleartext; you must first find the reverse of the MD5, then undo the salt operation in order to get the password. Bear in mind you cannot give salted cleartext because if you do, the salt will be applied again and the MD5 will be incorrect.

I believe, and correct me if I'm wrong, this is the way to retrieve passwords from a salted hash.

Vixje · Active user

Thanks a lot. I managed to reverse some already.

beastyarny · Regular user

you can use this program http://www.insidepro.com/eng/passwordspro.shtml it supports salt md5 hashes also

client · Beginner

// This funstion validates a plain text password with an
// encrpyted password
function tep_validate_password($plain, $encrypted) {
if (tep_not_null($plain) && tep_not_null($encrypted)) {
// split apart the hash / salt
$stack = explode(':', $encrypted);

if (sizeof($stack) != 2) return false;

if (md5($stack[1] . $plain) == $stack[0]) {
return true;
}
}

return false;
}

315099fd1bb6ebdffb4144afa625f210:bb
016d5992130db7b74bad9dde1b35d1e0:be
Can anyone reverse this from me?
Is this the right way:
For 315099fd1bb6ebdffb4144afa625f210:bb to put "bb" in front of every word in my wordlist ?
Is this the only way ?

waraxe · Site admin