+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Decrypting mysql Hash to plain password (/showthread.php?tid=5685878)
Decrypting mysql Hash to plain password - dark0v3rrid3 - Aug 3, 2017
First off sorry for my bad english.
I have an old application who connects to an localhost mysql server with a fixed username, password, database name and query. I like to rebuild the database side.
I tried to reverse engineer the application to find out the password with OllyDBG butt someone made some good effort to hide the password. Then i tried a different approach.
I tried sniffing the traffic with wireshark without no usefull packages captured after googling i found out that on Windows 7 x64 the localhost traffic is not captured by wireshark. After googling a lot more i tried an different approach again.
This time i used RawCap to capture my localhost traffic while hitting the buttons in the application multiple times after this i openened the pcap file in wireshark and finally i got some usefull packages.
1. Server Greeting
2. Login Request
This lead me to 1 database name and 1 username butt each hit i get a different password hash.
Password: 4df1ffa6f91a413053a3b65fe430e44b8f995223
Password: 6b7b516d9ca10440ff06393629bc5d6a59f59bd0
I think its a SHA1 hash with a Salt.
The question is do i get the salt for the password from the server greeting
Example: My server greeting package contains Salt: Pl]Z6@`X0]\033a and the login request contains Password: 4709e845de04eb041c9711b4cc247adc5e260a36
Thanks in advance.
* - dark0v3rrid3 - Oct 16, 2017
After following the executable in OllyDbg I finally found the password algorithm en followed the Stack to give me the value before encryption and now I finnaly have the password and did more searching in the application with Olly to retrieve the tables en columns used in MySQL. I recreated the complete backend and now everything works.
This post can be closed now butt I don't know how