How to reset password via mysql? (no mail)

[faqqalea]

Dear all,

I cannot implement the mail functionality due to internal security restraints, hence cannot reset my password via the Forgotten Password link, but would nevertheless like to recover my lost password.
I have access to the DB via phpMyAdmin or MySQL console, plus the filesystem.

phpMyFAQ 2.8.10
XAMPP 3.1.0

Tried already to update via SQL query, hashing both with PASSWORD() and MD5(), seems doesn't work (hash is visibly shorter than the other users and passwords in the system).
Tried to set it to empty or NULL, but the interface requires anyway some input.

And, of course, I forgot all of them, so cannot even copy a known password back in to my Administrator account.

Thank you for your help,
DD

[Thorsten]

Hi,

do you use the default hashing? https://github.com/thorsten/phpMyFAQ/bl ... s.php#L123

bye
Thorsten

[faqqalea]

Hi,

Most probably not

Do you happen to know how could I encrypt a string with that hashing method?
Either via SQL command like PASSWORD(xxx) or online tool, in any case I will have to add it to the "pass" field in the faquserlogin table, via an update query in phpmyadmin or MySQL console.

Thanks!

[Thorsten]

Hi,

I can create a query if you tell me your encryption type, it depends on the setting in the constants.php file.

bye
Thorsten

[faqqalea]

It is as you linked in the GIT:

define('PMF_ENCRYPTION_TYPE', 'hash');

Not sure what kind of hash is that though (it's not an SHA1 nor MD5).

[Thorsten]

Hi,

it's sha256 with a salt: https://github.com/thorsten/phpMyFAQ/bl ... sh.php#L46

The salt is stored in the table faqconfig with the key "security.salt"

bye
Thorsten

[faqqalea]

Thanks for the reply,

I've tried some online tools that generate SHA256 hash with Salt (taken from the db), replaced the stored password with this new generated one but still it doesn't really work.
e.g.: http://www.insidepro.com/hashes.php?lang=eng

Now I'm really out of options and not sure where I'm wrong.

Would anyone be so kind as to generate a password, let's say "phpmyfaq" without quotes, with the same hash, and with salt "276222dd2ac015839499f9b09b06c770" (without quotes)?

D

[Thorsten]

Hi,

it's

bfed41c43a10f19db065fd5299a1c53990ab6787ef83c435dd795fe32aba2e02thorsten

bye
Thorsten

[faqqalea]

Hi,

Sorry to keep bothering for this simple thing, but it's unfortunately the same hash as the one I've managed to generate before.

Replaced via phpMyAdmin in the table faquserlogin:
User: Administrator
Pass: bfed41c43a10f19db065fd5299a1c53990ab6787ef83c435dd795fe32aba2e02

When trying to login it gives me Wrong login name or password., tried to copy it to another user, same result
I'm out of options... shall I reinstall the whole application?

D

[Thorsten]

Hi,

please contact me via e-mail: thorsten AT phpmyfaq DOT de

We'll find a solution.

bye
Thorsten

[cybrid]

Hi Thorsten,

I have the same problems with password encryption.
The hash is not working in PMF. Maybe $str contains more then just the password and the salt.

I need it to make a mass user implementation script:
http://www.phpmyfaq.de/forum/viewtopic.php?f=2&t=16456

I'm looking forward for some more information.

[slithyToves]

I'm having these same problem as well. I used that php script you provided with my salt but I'm still unable to login.

[Thorsten]

Hi,

you can send me your data via email, so I can create a script for you.

bye
Thorsten