1

The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any credits so he can't use a CC to verify his account to customer service.

I know that Skype should have a saved AES-256 and SHA1 encrypted version of the MD5 hash of his password, and he thinks that it should not be a complex password (i.e. rockyou with some rules applied should be able to beat it).

He is on a Windows machine and sent me the config.xml file, which I read online contains the encrypted hash. How do I extract the MD5 from the config.xml file? I've tried some simple "john config.xml" kind of efforts, but I assume that because it's AES-256/SHA1 over an MD5 it can't be that simple. How do I go about getting to the MD5?

Improve this question

1 Answer 1

Reset to default
3

First off, I'd consider calling support: https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password

Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427

It is NOT as simple as running JTR on the conf.xml file ....

Improve this answer
4
  • I'll let him know about the forgotten password thing I just assumed with nothing to verify that they wouldn't be able to give him his account back. the config.xml file doesn't have the <credentials3> tag mentioned in the article posted (very cool article btw), but perhaps this is an update?
    – BSpiros
    Commented May 8, 2013 at 15:34
  • @BSpiros - His config file doesn't becuse his configuration file was reset. He should be sure to change the registered email address to an email account he has access to or simply create the account again.
    – Ramhound
    Commented May 8, 2013 at 17:41
  • @Ramhound - Was it reset when he failed a login attempt?
    – BSpiros
    Commented May 8, 2013 at 17:50
  • @BSpiros - More then likely.
    – Ramhound
    Commented May 8, 2013 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .