Any idea of decrypting this one?

puikaaa
8 years ago | edited 8 years ago

0

Hi guys.

So I got these hashes

*7ADEEF2C425560589BF6CC0720E272EB1D58A432 *77C22AC27415B9AAF7A7F89FE112463C98B19330 *A32F00094ACFA3524979F7DE55150045E7D890E4 *1F3632E9D6652877C3DD60B26E4F63F545506877 *7E11486C98A1B1D1302058C0D0F944464F5155D1 *1F3632E9D6652877C3DD60B26E4F63F545506877

hash-identifier reports them as:
MySQL 160bit - SHA-1(SHA-1($pass))

All hashcat methods reports:
Skipping line: *1F3632E9D6652877C3DD60B26E4F63F545506877 (line length exception) Skipping line: *77C22AC27415B9AAF7A7F89FE112463C98B19330 (line length exception) Skipping line: *7ADEEF2C425560589BF6CC0720E272EB1D58A432 (line length exception) Skipping line: *7E11486C98A1B1D1302058C0D0F944464F5155D1 (line length exception) Skipping line: *A32F00094ACFA3524979F7DE55150045E7D890E4 (line length exception)

Does anybody have an idea how to decrypt them?
I’ve spent 2 days in research and decrypting them with no luck.

Thank you in advance. Cheers! :)

ERGY13
8 years ago

0

perhaps if you remove the star before the chain ?

( I really don’t know. )

puikaaa
8 years ago | edited 8 years ago

0

@ERGY13 the ***** is a part of MySQL 5 hash.

So far I know:
[list=1]
[] It is SHA1
[] It is crypted using double SHA1 method sha1(sha1($password))
[] Those are PMA admin password hashes
[] Server runs MySQL 5.0.1
[/list]

ERGY13
8 years ago

0

perhaps you can bruteforce, but it will take time. don’t know other solutions.

puikaaa
8 years ago | edited 8 years ago

0

@ERGY13 in process. But I don’t hope that it will find something.
Input.Mode: Dict (/usr/share/wordlists/rockyou.txt) Index.....: 1/5 (segment), 3627099 (words), 33550339 (bytes) Recovered.: 0/5 hashes, 0/1 salts Speed/sec.: 3.89M plains, 109 words Progress..: 203134/3627099 (5.60%) Running...: 00:00:30:49 Estimated.: 00:08:43:32

Bruteforcing char by char is my next and probably final option. It will return something, but my little monster will process it in a week or so.

ERGY13
8 years ago | edited 8 years ago

0

i wasn’t thinking with a dictionary.


while [ $endend = false ]; do  
     # generating varchar methodically ( aaa;aab;aac;...) >> /tmp/pass.list  

     # if chain = z(x32)  
     if [ "$ended" = "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz" ]; then  
          endend=true  
     fi ;  
done ;  

cat /tmp/pass.list | grep "*1F3632E9D6652877C3DD60B26E4F63F545506877"  
cat /tmp/pass.list | grep "*77C22AC27415B9AAF7A7F89FE112463C98B19330"  
cat /tmp/pass.list | grep "*A32F00094ACFA3524979F7DE55150045E7D890E4"  
cat /tmp/pass.list | grep "*1F3632E9D6652877C3DD60B26E4F63F545506877"  
cat /tmp/pass.list | grep "*7E11486C98A1B1D1302058C0D0F944464F5155D1"  
cat /tmp/pass.list | grep "*1F3632E9D6652877C3DD60B26E4F63F545506877"

this is what I was thinking. but it ill take really a lot of time.

EDIT : sorry, i just seen now (too late) your ending sentence.

cn9 [1337boy]
8 years ago

0

Why are you doing that? Where are these hashes coming from?

WaRWolFz crew

puikaaa
8 years ago

0

Random hashes from random database - for learning purposes only @1337boy :)

dloser
8 years ago

0

Seeing as these are indeed most likely MySQL hashes (>=4.1), there is no decrypting them. Why is that again?

checks forehead

Because it’s not an encryption! Right! ;)

puikaaa
8 years ago | edited 8 years ago

0

@dloser you know what I meant. :p

Still it is cryptography. So if it is string, put in input, then processed using double sha1, it is crypted password string. So decrypting it is. Why? Because PHPMyAdmin uses sha1 function built in PHP. Well, at least my brain today thinks so. Prove me wrong. I’d be glad to find my errors and fix them. Really!

A beautiful quote from MySQL WIKI
[quote=MySQL Support]You can also use SHA1() as a cryptographic function for storing passwords.[/quote]

dloser
8 years ago

0

“… use … as a cryptographic function …” != encryption. There is no key used for SHA1 and there exists no inverse function for it. Not an encryption.

All you can do is to try and find pre-images, which is made intentionally hard if it’s a cryptographic hash. And even if you find one, technically you will never know if it was the same one used to produce the hash.

puikaaa
8 years ago

0

Well, on bright side I just learned something new. :)
English is not my native.

Thanks @dloser for input.

I think i’ll then just use XSS and shell injection. Vega is a hell of a drug. :D