0

I spended all day looking for a solution for my problem and finally decided to make a post asking for help. I really dont know if this is the best place to post this but maybe someone can help me.

So im trying to create a simple login form in C# Everything works fine on getting the username,MD5(password) and salt from the database. Now my problem is how to make the compare from the password + salt inputed from my form. I have no idea how vbulleting stores the password when user creates an account on the forum, nor i have idea how he generates a salt, if its random, or username bases, and how many itenerations he takes.

Can anyone help me?

EDIT: -

$vbulletin->userinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password, md5($md5password . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password_utf, md5($md5password_utf . $vbulletin->userinfo['salt']), '')

found that, but still have no clue how they make it, so ican try to reproduce it in c#

Best Regards, Magg

7
  • MD5 for passwords is already broken .. anyway, maybe the vbulletin infrastructure is documented? And if not, maybe the source (PHP?) can be viewed? Remember to verify a hash+salt password, use the algorithm: hash(combine(salt, input)) == hashed. In this case I imagine that hash is equivalent to md5 (as stated), but the method of combining the salt with the input can vary although usually it is just prepended. Jun 29, 2013 at 21:24
  • Also, nothing to do with the database, since "works fine on getting the .. from the database". Jun 29, 2013 at 21:29
  • Oh, hmm, seems like I was confusing vBulletin with one of the common PHP boards .. but same idea holds. Have to know (or determine) the hash algorithm, salt combination strategy, and any additional details (like HMAC, if used). Jun 29, 2013 at 21:31
  • yeh the problem is not to retrieve the values from the database, its comparing the passwords, cause no matter what method i try they never match. Jun 29, 2013 at 21:32
  • even using this link and providing the right password + right salt + right username none of the results come valid. Jun 29, 2013 at 21:43

2 Answers 2

0

Given the code, formatted (and ignoring this might break the syntax):

    $vbulletin->userinfo['password'] != iif($password AND !$md5password,
        md5(md5($password) . $vbulletin->userinfo['salt']), '')
AND $vbulletin->userinfo['password'] != iif($md5password,
        md5($md5password . $vbulletin->userinfo['salt']), '')
AND $vbulletin->userinfo['password'] != iif($md5password_utf,
        md5($md5password_utf . $vbulletin->userinfo['salt']), '')

This expression detects "failure of all methods", but because I find that hard to read, let's rewrite it as a positive match for "success of any method" by applying De Morgan's with an implicit outside negation:

    $vbulletin->userinfo['password'] == iif($password AND !$md5password,
        md5(md5($password) . $vbulletin->userinfo['salt']), '')
OR  $vbulletin->userinfo['password'] == iif($md5password,
        md5($md5password . $vbulletin->userinfo['salt']), '')
OR  $vbulletin->userinfo['password'] == iif($md5password_utf,
        md5($md5password_utf . $vbulletin->userinfo['salt']), '')

Now, apply simplification and noting and that iff(x,y,z) works like x?y:z we end up with something about like the following in C#:

   storedPW == password && !md5password ? md5(md5(password) + salt) : ''
|| storedPW == md5password ? md5(md5password + salt) : ''
|| storedPw == md5password_utf ? md5(md5password_utf + salt) : ''

The checks are little bit ugly, but .. not my code. The important bit to realize is the pattern is:

 md5(md5(password) + salt) -> storedPw

Unfortunately, this should have matched md5(md5($pass).$salt) from the insidepro link - when using that tool, make sure you're supplying the plain text password and not the hash from the database.

YMMV.

1
  • Thank you for explaining that to me, it really helped me understand it better, but it still dont work. Like i said in insidepro i provided the plain text password + salt from the database and it still didnt matched. This is really getting on my nerves by now. lol Jun 30, 2013 at 7:34
0

So heres the solution to my problem, finally i managed to get it working.

The problem was that C# uses all strings as unicode, and vbulletin uses all strings as UTF8

For the sake of testing, i created a new form, added a new textbox and a button. This dont connect in anyway to the database, and i provided the salt directly tooken from the database.(for the sake of testing)

Since was already stated vbulleting logins as the following: md5(md5(password)+salt)

So to reproduce the same in C# but using UTF8 heres the solution:

static public string GetMd5Sum(string str)
    {
        //vBulletin uses UTF8 as strings, so you need to pass the user input string as UTF8 also
        Encoder enc = System.Text.Encoding.UTF8.GetEncoder();

        //Create a byte[] array to store the new UTF8 string
        byte[] utf8text = new byte[str.Length];

        //Pass the string to the byte[] array
        enc.GetBytes(str.ToCharArray(), 0, str.Length, utf8text , 0, true);

        //Hash the byte[] array with our UTF8 string inside
        MD5 md5 = new MD5CryptoServiceProvider();
        byte[] result = md5.ComputeHash(utf8text);

        //Build the final string by converting each byte
        //into hex and appending it to a StringBuilder
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < result.Length; i++)
        {
            sb.Append(result[i].ToString("x2")); //x2 here so the outcome result is all in lowercase, couse vbulleting also stores all in lowercase
        }

        //And return it
        return sb.ToString();
    }

    private void button1_Click(object sender, EventArgs e)
    {
        //Get the user input password as plain text
        string pass = textBox1.Text;

        //Here i provided the salt explicit that i took from the database
        string salt = "N1GOt=>8sdO@E54)PH2@NCm5yI#]3u";

        //Here we convert the plain text password into the first hash
        string p1 = GetMd5Sum(pass);

        //Here we add the salt to the previous hashed password
        string p2 = p1 + salt;

        //Here we hash again the previous hashed password + the salt string
        string final = GetMd5Sum(p2);

        //this was just to the test to see if it all works as intended
        MessageBox.Show(final);
    }

This will output the exact same hash stored in the database as password.

Thank you user2246647 for all your help on this problem i had.

1
  • Sweet, glad you got it working :D The conversion can be simplified some: byte[] bytes = Encoding.UTF8.GetBytes(str); For the casing issue, I'd consider either ToLower (at the end) or an invariant case-insensitive compare. Also make sure to Dispose the hash service provider for good habit - using is useful for this. There is also a nifty trick to help conversion into a hex string that can be found on SO (I think using a SOAP conversion ..) - well, accept your answer to close the question :D Jun 30, 2013 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.