WebEdition CMS

[NeonFlash]

Hi,

I noticed that there is no implementation of a hashing algorithm used in
WebEdition CMS yet. You can download the sourcecode from here:

Code:

http://www.webedition.org/de/webedition-cms/

This CMS is often used by German Websites. There are 2 options available to download and install this CMS. In order to study the source code, you can go for the Manual Installation option here:

Code:

http://sourceforge.net/projects/webedition/files/webEdition/6.2.1.0/webEdition_6210.tar.gz/download

I studied the source code, and after sometime I was able to figure out that the file, we_session.inc.php in the path:

/we/include/ has the information specific to the hashing algorithm.

On line 43 of the code we have,

Code:

$useSalt = $DB_WE->f("UseSalt");
$salted = md5($_POST["password"] . md5($_POST["username"]));

So, the hashing algorithm works as follows:

Based on the value of the useSalt field in database, it will decide whether to use the salted version of password or not.

The salted version will use the username as a salt. The algorithm becomes:

md5($p,md5($s))

This algorithm can be significantly accelerated on the GPU and it would be great to have it implemented in oclhashcat-plus

[epixoip]

In the interim you can manually md5 all of your usernames and then just crack them with -m 10.

Code:

epixoip@token:~/oclHashcat-plus-0.09$ printf epixoip | md5sum
7425755ff6e2d03b5549bda4924d9f49  -

epixoip@token:~/oclHashcat-plus-0.09$ printf 'test7425755ff6e2d03b5549bda4924d9f49' | md5sum
f473e920be74df4a5ce9c5a9b332ab45  -

epixoip@token:~/oclHashcat-plus-0.09$ ./oclHashcat-plus64.bin -d 1 -m 10 f473e920be74df4a5ce9c5a9b332ab45:7425755ff6e2d03b5549bda4924d9f49  -a 3 ?l?l?l?l
oclHashcat-plus v0.09 by atom starting...

f473e920be74df4a5ce9c5a9b332ab45:7425755ff6e2d03b5549bda4924d9f49:test

Status.......: Cracked
Input.Mode...: Mask (?l?l?l?l)
Hash.Target..: f473e920be74df4a5ce9c5a9b332ab45:7425755ff6e2d03b5549bda4924d9f49
Hash.Type....: md5($pass.$salt)
Time.Running.: 1 sec
Time.Util....: 1004.0ms/286.5ms Real/CPU, 39.9% idle
Speed........:   455.2k c/s Real, 39457.7k c/s GPU
Recovered....: 1/1 Digests, 1/1 Salts
Progress.....: 456976/456976 (100.00%)
Rejected.....: 0/456976 (0.00%)
HWMon.GPU.#1.: 99% Util, 86c Temp, 93% Fan

[atom]

If there is more demand I will add it to oclHashcat-plus. Please use epixoip's way in the meanwhile.