2

I was recently doing a penetration testing challenge and was able to extract the password hash of the remote user. I tried cracking the password using john the ripper and hashcat but both failed.

Long story short, is it possible to reverse a hashed MySQL5 password by any method other than brute forcing?

  • 1
    Did you try "cracking" your own remote user account hash with these tools, to be sure you're using them right? With just a hash, brute force is pretty much all you can do; however, MySQL credentials may be hardcoded in the shell's .history, config files, code etc. if you can find a way to search through them. – Jedi Jul 31 '16 at 20:57
  • I suppose it's a fair question to ask whether you are sure it's a MySQL password hash that you have. A MySQL password hash is 41 characters, * + 40 hex digits. (And how did you manage to get your hands on this? It sounds like the site is already seriously vulnerable to attack.) – Michael - sqlbot Jul 31 '16 at 22:34
  • @Jedi : Yep I did. The problem is the current password is not present in any of the commonly available word-lists. Searching through files is an interesting suggestion. But I only have access to the files that the mysql user have privileges to access to. – Neel Aug 1 '16 at 3:30
  • @Michael : yes I am pretty sure its a mysql password. I would have posted the hash here. But I don't know whether that is allowed here. And as I have already mentioned, this is from a pen testng challenge (similar to the one posted [here](madmantm.wordpress.com/2015/08/10/… ))where the OS is customized to be vulnerable with clues lying around. You just have to find them :-) – Neel Aug 1 '16 at 3:32
4

Welcome to Security.SE.

First, a brief explanation of hashing versus encryption, because that's important here.

Hashing and encryption

When talking about hashes, it is impossible to decrypt. Hashes are one-way and cannot be reversed to retrieve the plaintext. This matters because how you go about getting the plaintext is very different from encryption and hashing.

Finding the plaintext of a hash

John the Ripper and hashcat are both tools that can be used to find the plaintext of a hash. However, throwing a wordlist at them isn't always the most effective way to use those tools. You need to know a few things about the target, in addition to the algorithm used. You know you have a MySQL 5 hash, but here's some other things that will help you:

  • Is there a password policy? (minimum x characters, upper, lower, symbols, etc.)
  • If the administrator chose a common password, it may be in password lists. If the administrator did not, you may have to do additional reconnaissance to build a wordlist that is more directed at the user.

Is there another way besides brute forcing?

Short of a weakness in the algorithm itself, no. Hashes in general are intended to be resistant to attacks against the algorithm. While tools like John and Hashcat do try to make performance improvements against a particular algorithm given its properties, brute forcing, with keeping in mind what I mentioned above, is how hashes, MySQL hashes or otherwise, are attacked.

However, if you pulled a hash from a database in the challenge, that's different from pulling the MySQL user hash. That is, storing website users in a database doesn't necessarily use the MySQL hashing algorithm. It can be something else like MD5 or SHA1.

2

In short, no. By definition, hashes are one way encryption and can't be de-hashed. That is why the best way to crack a hash is to pseudo-randomly encrypt strings of texts and compare the encryption output to the hash you already have.

If brute forcing the hash isn't working, you can try the following:

  • Check the hash on an online rainbow table site like crackstation, hashkiller, freerainbowtables, etc.
  • Try a dictionary attack
  • Try a narrowed down version of a brute force attack
  • Try masked combinations of dictionary attacks (for instance, first letter in caps, adding a year to the end of the password string, etc.)

Try to understand the user What do you know about the user whose password you are trying to crack? For instance, if he's from an English-speaking country, try a dictionary attack from an English language dictionary.

Does the username reveal any clues? For instance, if his username is frodo123, then you might want to create or download a dictionary with Lord of The Rings keywords and run a dictionary (and masked dictionary) attack with those words.

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.