The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any credits so he can't use a CC to verify his account to customer service.

I know that Skype should have a saved AES-256 and SHA1 encrypted version of the MD5 hash of his password, and he thinks that it should not be a complex password (i.e. rockyou with some rules applied should be able to beat it).

He is on a Windows machine and sent me the config.xml file, which I read online contains the encrypted hash. How do I extract the MD5 from the config.xml file? I've tried some simple "john config.xml" kind of efforts, but I assume that because it's AES-256/SHA1 over an MD5 it can't be that simple. How do I go about getting to the MD5?


First off, I'd consider calling support: https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password

Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427

It is NOT as simple as running JTR on the conf.xml file ....

  • I'll let him know about the forgotten password thing I just assumed with nothing to verify that they wouldn't be able to give him his account back. the config.xml file doesn't have the <credentials3> tag mentioned in the article posted (very cool article btw), but perhaps this is an update? – BSpiros May 8 '13 at 15:34
  • @BSpiros - His config file doesn't becuse his configuration file was reset. He should be sure to change the registered email address to an email account he has access to or simply create the account again. – Ramhound May 8 '13 at 17:41
  • @Ramhound - Was it reset when he failed a login attempt? – BSpiros May 8 '13 at 17:50
  • @BSpiros - More then likely. – Ramhound May 8 '13 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.