Hướng dẫn phpmyadmin password hash decrypt

How can I decrypt MySQL passwords

Nội dung chính Show

• Can you decrypt a MySQL password?
• How do I find my phpMyAdmin password?
• How do I decrypt encrypted data in MySQL?
• How do I decrypt a table in MySQL?

Nội dung chính

• Can you decrypt a MySQL password?
• How do I find my phpMyAdmin password?
• How do I decrypt encrypted data in MySQL?
• How do I decrypt a table in MySQL?

You can't really because they are hashed and not encrypted.

Here's the essence of the PASSWORD function that current MySQL uses. You can execute it from the sql terminal:

mysql> SELECT SHA1(UNHEX(SHA1("password")));

+------------------------------------------+
| SHA1(UNHEX(SHA1("password")))            |
+------------------------------------------+
| 2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |
+------------------------------------------+
1 row in set (0.00 sec)

How can I change or retrieve these?

If you are having trouble logging in on a debian or ubuntu system, first try this (thanks to tohuwawohu at https://askubuntu.com/questions/120718/cant-log-to-mysql):

$ sudo cat /etc/mysql/debian.conf | grep -i password
...
password: QWERTY12345...

Then, log in with the debian maintenance user:

$ mysql -u debian-sys-maint -p
password:

Finally, change the user's password:

mysql> UPDATE mysql.user SET Password=PASSWORD('new password') WHERE User='root';
mysql> FLUSH PRIVILEGES;
mysql> quit;

When I look in the PHPmyAdmin the passwords are encrypted

Related, if you need to dump the user database for the relevant information, try:

mysql> SELECT User,Host,Password FROM mysql.user;
+------------------+-----------+----------------------+
| User             | Host      | Password             |
+------------------+-----------+----------------------+
| root             | localhost | *0123456789ABCDEF... |
| root             | 127.0.0.1 | *0123456789ABCDEF... |
| root             | ::1       | *0123456789ABCDEF... |
| debian-sys-maint | localhost | *ABCDEF0123456789... |
+------------------+-----------+----------------------+

And yes, those passwords are NOT salted. So an attacker can prebuild the tables and apply them to all MySQL installations. In addition, the adversary can learn which users have the same passwords.

Needles to say, the folks at mySQL are not following best practices. John Steven did an excellent paper on Password Storage Best Practice at OWASP's Password Storage Cheat Sheet. In fairness to the MySQL folks, they may be doing it because of pain points in the architecture, design or implementation (I simply don't know).

If you use the PASSWORD and UPDATE commands and the change does not work, then see http://dev.mysql.com/doc/refman/5.0/en/resetting-permissions.html. Even though the page is named "resetting permissions", its really about how to change a password. (Its befuddling the MySQL password change procedure is so broken that you have to jump through the hoops, but it is what it is).

[quote author=ShogunWarrior link=topic=115877.msg522114#msg522114 date=1170713024]
[quote author=Azu link=topic=115877.msg522106#msg522106 date=1170712462]
because there are many different combinations that could make it.[/quote]

The whole point of hash functions(MD4,MD5,SHA1) is that any unique data input into it will create a unique hash.
I.E: Two different inputs _should_ never create the same hash. If it was the case the 1000 differents pasword had the same hash then how would you verify passwords?
[/quote]

I think there is a lot of confusion and disinformation here. MD5 cannot be decrypted - never, no how, no way.

An MD5 hash creates a 32 character string consisting of letters and numbers. There are 26 letters plus 10 numbers which = 36. With 32 characters the total number of MD5 hashes possible is 26^32 (26 to the power of 32). That is a finite (albeit a very large) number of possible values of 170,141,183,460,469,231,731,687,303,715,884,105,728. But, you can create an MD5 has of an infinite number of values. So, there are some values that will create the exact same hash. These are referred to as collisions.

Now, the probability that someone types in a incorrect password and it passes an MD5 check because of a collision is so astronimical that it doesn't need to be considered. but, those collisions do exist.

The above reason is also why MD5 cannot "really" be cracked or decrypted. Because any one hash can have many different values that created it there is no way to really know what value was used to create the hash. But, because "most" values that are MD5 hashed are passwords or other small strings, there are MD5 lookup tables where common words and values have been identified with their MD5 hash.

Here is a sample MD5 lookup page: http://nz.md5.crysm.net/

If you were to enter the value (1f3870be274f6c49b3e31a0c6728957f) it will tell you that the value for the hash is "apple" because it would be the most logical choice even though there are many more values that could create that hash - although they probably aren't anything legible.

If you were to enter the hash (feb1808680d0d4f855b88981e88a0a97) it would tell you that it doesn't know what that is because I created it using the value "NsdJS#DFu^DSH(fUE".

Can you decrypt a MySQL password?

You can't decrypt MySQL passwords, because the are hashed by using MD5 hash algorithm, which is not an encryption algorithm.

How do I find my phpMyAdmin password?

Show activity on this post. You can access that database with the user/password used to login on the phpMyAdmin. You can also create new users (if you have permission to) under the tab Privileges > Add new User. Here you can create pairs of user-database with the same name and auto-permission-granting.

How do I decrypt encrypted data in MySQL?

The MySQL AES_DECRYPT function returns the original string after decrypting an encrypted string. It uses AES(Advanced Encryption Standard) algorithm to perform the decryption. The AES_DECRYPT function returns the decrypted string or NULL if it detects invalid data.

How do I decrypt a table in MySQL?

The MySQL DES_DECRYPT function is used for decrypting an encrypted string using DES(Data Encryption Standard) algorithm. The MySQL DES_DECRYPT function uses a key to decrypt a string. The value returned by the DES_DECRYPT function is a decrypted string or NULL.