Is it possible to crack Joomla hash password?

Question

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack this hash password?

Answer 1

Just as Swashbuckler said - "decrypt" or "dehash" or "reverse" are almost always the wrong words for attacking password hashes.

But you can try to crack them - even with an unknown salt. This involves trying many possible strings, to see if they result in the same hash. It is harder if the salt is also unknown.

If it's older Joomla, it's MD5-ish (though I'm not sure of the details there, digging into the source code for older Joomla or John the Ripper or hashcat would probably tell you). Newer Joomla uses phpass, so there are quite a few possible salts, so this would probably be non-trivial (unless the password is trivial).

Edit: Looking at this answer and other sources, unless yours was a custom naive implementation, Joomla hashes prior to 2.5.18 had a large 32-hex salt (16^32 or ~34x10^38 possibilities). Even if the password is 'password', cracking this hash without the salt would be very unlikely.

Answer 2

If you were able to obtain the hash, you probably can obtain the salt too. I don't know about Joomla, but every software I have seen stores the password hash and the salt together in the same table or even as a sole string

If you have both of them you could try to perform bruteforce attacks, that is, hash every possible password using that salt and check if it's the same. This is time expensive as you have to iterate through all possible characters for every position in the password. Using all printable character gives you 100^(password length) possible passwords, and if you don't know the actual password length you should repeat this process for every possible length

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash

From what you're saying, it seems like you forgot your own password or an already known one. In this case I'd recommend creating a password dictionary with simple password that you might have used and apply a rule based attack using hashcat or john the ripper. This dictionary should NOT have transformations, f.e. if your password is P@s5W0rd! the dictionary should contain only password as the rules will make all possible transformations. How rule based attacks work is beyond the scope of this question, but the hashcat documentation explains it very well and hashcat itself includes a lot of rules for common transformations.

Furthermore, if you're attempting to recover access to a Joomla instance and you have write access to the database, is way more optimal to just override the hash and the salt. To do that you could just take a look at the Joomla source code to see how it's hashed and do the same with a newly known password or use a web application like this one (In case you go with the web application, for better security please change your password through Joomla after setting a new one in the database)