0

I can't found the hash type used in a database hosted in a VM.

My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called password_type. It hold the value "default". Also the username is "aya".

I tried to use hash-identifier to detect the hash. This is the result:

 HASH: c39e02416d974229752c28d7fcefe6e1        

Possible Hashs:
[+]  MD5
[+]  Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))

Least Possible Hashs:
[+]  RAdmin v2.x
[+]  NTLM
[+]  MD4
[+]  MD2
[+]  MD5(HMAC)
[+]  MD4(HMAC)
[+]  MD2(HMAC)
[+]  MD5(HMAC(Wordpress))
[+]  Haval-128
[+]  Haval-128(HMAC)
[+]  RipeMD-128
[+]  RipeMD-128(HMAC)
[+]  SNEFRU-128
[+]  SNEFRU-128(HMAC)
[+]  Tiger-128
[+]  Tiger-128(HMAC)
[+]  md5($pass.$salt)
[+]  md5($salt.$pass)
[+]  md5($salt.$pass.$salt)
[+]  md5($salt.$pass.$username)
[+]  md5($salt.md5($pass))
[+]  md5($salt.md5($pass))
[+]  md5($salt.md5($pass.$salt))
[+]  md5($salt.md5($pass.$salt))
[+]  md5($salt.md5($salt.$pass))
[+]  md5($salt.md5(md5($pass).$salt))
[+]  md5($username.0.$pass)
[+]  md5($username.LF.$pass)
[+]  md5($username.md5($pass).$salt)
[+]  md5(md5($pass))
[+]  md5(md5($pass).$salt)
[+]  md5(md5($pass).md5($salt))
[+]  md5(md5($salt).$pass)
[+]  md5(md5($salt).md5($pass))
[+]  md5(md5($username.$pass).$salt)
[+]  md5(md5(md5($pass)))
[+]  md5(md5(md5(md5($pass))))
[+]  md5(md5(md5(md5(md5($pass)))))
[+]  md5(sha1($pass))
[+]  md5(sha1(md5($pass)))
[+]  md5(sha1(md5(sha1($pass))))
[+]  md5(strtoupper(md5($pass)))

I tried to generate the hash using my password "azerty123456" and salted it with either my username or the value of the password_type column, but I don't get the same hash.

  • Do you have any other hints to work with, like what application generated these password hashes? – Mike Ounsworth Mar 15 at 1:15
  • its a php script – ayadi Mar 15 at 1:21
  • 2
    Can you generate new passwords? Try a „a“ and „b“ and try to set the same password multiple times. Also try different users with same password. Also look for a seed/pepper Key in the config files or tables. Or just post the name/vendor of the app. – eckes Mar 15 at 2:48
  • 1
    Hashes are not designed to tell you "This hash was generated via MD5". Given that you know the output is 128 bit, it's likely to be MD5. What you are trying to figure out now is "Which input was used to generate this hash?". This question is more commonly known as "Cracking a hash" and without access to the source code, guessing the format will not be easy either. – MechMK1 Mar 15 at 13:39
  • 1
    it confirmed that even I change the username I get the same password, I used a new account and another username , with the same password and i get the same hash – ayadi Mar 15 at 16:18
2

There's not a lot of information to work with here, as your hash-identifier tool has already pointed out.

Things we know:

  1. c39e02416d974229752c28d7fcefe6e1 is 16 bytes (or 128 bits). There are no modern hash functions with an output this short, so that suggests that it's likely MD5. (unless its something like SHA1 truncated to 128 bits, but who would do that??)
  2. Your hash-identifier tool could not figure it out, which means they're doing some obfuscation; adding the username as a salt in a weird way, or using an application-wide salt, or using a MAC with an application-wide secret key, or iterating the hash some number of times, or some combination.

Unfortunately, unless you can find some more information in the database that gives you some hints (or if you can get access to the source code of the php application), then you are faced with a hard reverse-engineering problem :(

  • "id,username,password,email,mobile,register_ip,register_time,register_user_agent,last_login_ip,last_login_user_agent,lang,vip_plan,vip_end_time,ref_id,is_admin,wallet,wallet_usd,password_security,password_type,action_id" these are the columns in "user" table. there are some dynamic values and some constant . I try to combine my password with some constant value but I need a program that helps me to generate every combination . – ayadi Mar 15 at 1:57
  • What's in the password_security column? – Mike Ounsworth Mar 15 at 2:37
  • I knew that u will ask ! for a normal user its an empty field but for admin (its hold a hash and the password field hold half of another a hash ) exemple admin password : 224beb70bd7d3f29efbbeeb password_security : 663a40bd51b9afdaeed7a8d5c163f342 – ayadi Mar 15 at 2:50
  • I return to my Tables list to see if there are any hints... I found 3 tables related to user authentication. login , login_security , token Table: login [6 columns] key, time, id, ip, login_type, user_id FROM login WHERE (user_id = my_id) [*] 3fdab63fce14174f99b8be67b6b0958b, 1552665788, 29517, XX.XX.XX.XX, system, my_id – ayadi Mar 15 at 16:57
  • 3fdab63fce14174f99b8be67b6b0958b is in same type as password wolumn in table user (according to hash-identifier comparaison ) – ayadi Mar 15 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.