0

I am developing a system for Online Hotel booking system which I did not start from scratch. The information of customers(bookers) in the system are encrypted using MD5 but unlike normal md5() php function the system is quite complicated as you can see here : 

$psw = md5("vhdsxnjuobef");
$t_cred_num = md5_encrypt($t_cred_num, $psw, 16);

and for Decryption it goes like :

$psw = md5("vhdsxnjuobef");
$t_credit_num = md5_decrypt($t_cred_num, $psw, 16);

this code is not Working though on my Server and there is alot of Customer's information Encrypted.

Example of hash of t_cred_num variable =>

 fdRucZHctr7vIX+U400xGHq53Qemze0YQH1sAUjvmaC1P+XaRadI9CaX0wrkDXu6

Any Ideas on how to Decrypt these hashes ? When I use md5_decrypt with the hashes nothing happens.

Skyliquid
  • 374
  • 1
  • 5
  • 23
  • A __one-way__ "hash" such as md5 is called "one-way" for a reason; hashes cannot be "converted" back to the original... you _cannot_ "decrypt" a hash.... so what does your md5_encrypt() function actually do? – Mark Baker Jan 28 '14 at 23:26
  • OH my. Hashing and encryption are two different things. md5_encrypt is not a built-in function, you have to find it in the codebase and post it here. – Digital Chris Jan 28 '14 at 23:26
  • I cant find those 2 functions in the code for his System. but when I copy and paste on my Server it dont work. Maybe its an Extension ? – Skyliquid Jan 28 '14 at 23:29
  • 1
    think I found the functions: http://www.jonasjohn.de/snippets/php/md5-based-block-cipher.htm – bitWorking Jan 28 '14 at 23:39
  • this is Exactly the functions – Skyliquid Jan 28 '14 at 23:42
  • 1
    more info: http://stackoverflow.com/questions/6503033/just-want-to-decode-the-code-into-plain-text – bitWorking Jan 28 '14 at 23:45
  • I added the functions in the same Code and still not working, What Am I missing ? http://pastebin.com/VeQajyYw – Skyliquid Jan 28 '14 at 23:45
  • nothing happens? enable error reporting and you should get a message.. – bitWorking Jan 28 '14 at 23:47
  • Oh I have it Working Now, Thank you so Much. feel free to make an Answer for my question linking http://stackoverflow.com/questions/6503033/just-want-to-decode-the-code-into-plain-text and I will mark you as the correct answer – Skyliquid Jan 28 '14 at 23:49
  • 3
    **Do not use these functions.** They are misusing MD5 in an incredibly insecure fashion. –  Jan 28 '14 at 23:53
  • @duskwuff, insecure for what kinds of attacks other than Bruteforcing and rainbow ? – Skyliquid Jan 28 '14 at 23:57
  • 5
    A full analysis of the insecurity of this function would not fit into this comment box. Suffice it to say: It has a number of serious cryptographic flaws that leave it wide open for analysis. Use a cipher algorithm designed by a real cryptographer. –  Jan 29 '14 at 01:39
  • 1
    Credit card numbers are very sensitive information, whenever possible you should not store them at all, have a look at the answers of this [question](http://stackoverflow.com/q/18065367/575765). If you really need to store them, you have to comply with the [PCI standard](https://www.pcisecuritystandards.org/security_standards/getting_started.php). The problem with credit card numbers is, that they are short and must be decryptable, that makes it very hard to store them safely. – martinstoeckli Apr 15 '14 at 07:55

2 Answers2

1

I think the md5_crypt and md5_encrypt are functions hand crafted by the previous developer. md5 isn't supposed to be decryptable. Hash's are supposed to be one way functions: http://en.wikipedia.org/wiki/Hash_function

So, you'll need to find the definition of those functions. A search for "function md5_" in the code files should find the place in the code where they are defined.

Joey Novak
  • 173
  • 7
0

there's no way to decrypt an md5. there are two things you can do:

  1. if you have other account or know the password of another account then copy the md5 characters of it and place it on yours.
  2. search for an md5 of let's say "admin". Paste the md5 equivalent of the word "admin" on your account. You can also use other words.

After that, login to your account then change back your password

Kirit Patel
  • 122
  • 9