[dark0v3rrid3]

First off sorry for my bad english.

I have an old application who connects to an localhost mysql server with a fixed username, password, database name and query. I like to rebuild the database side.

I tried to reverse engineer the application to find out the password with OllyDBG butt someone made some good effort to hide the password. Then i tried a different approach.

I tried sniffing the traffic with wireshark without no usefull packages captured after googling i found out that on Windows 7 x64 the localhost traffic is not captured by wireshark. After googling a lot more i tried an different approach again.

This time i used RawCap to capture my localhost traffic while hitting the buttons in the application multiple times after this i openened the pcap file in wireshark and finally i got some usefull packages.

1. Server Greeting
2. Login Request

This lead me to 1 database name and 1 username butt each hit i get a different password hash.

Password: 4df1ffa6f91a413053a3b65fe430e44b8f995223
Password: 6b7b516d9ca10440ff06393629bc5d6a59f59bd0

I think its a SHA1 hash with a Salt.

The question is do i get the salt for the password from the server greeting

Example: My server greeting package contains Salt: Pl]Z6@`X0]\033a and the login request contains Password: 4709e845de04eb041c9711b4cc247adc5e260a36

Thanks in advance.

[dark0v3rrid3]

After following the executable in OllyDbg I finally found the password algorithm en followed the Stack to give me the value before encryption and now I finnaly have the password and did more searching in the application with Olly to retrieve the tables en columns used in MySQL. I recreated the complete backend and now everything works.

This post can be closed now butt I don't know how