使用C＃对vBulletin数据库进行身份验证

Question

I spended all day looking for a solution for my problem and finally decided to make a post asking for help. I really dont know if this is the best place to post this but maybe someone can help me.

So im trying to create a simple login form in C# Everything works fine on getting the username,MD5(password) and salt from the database. Now my problem is how to make the compare from the password + salt inputed from my form. I have no idea how vbulleting stores the password when user creates an account on the forum, nor i have idea how he generates a salt, if its random, or username bases, and how many itenerations he takes.

Can anyone help me?

EDIT: -

$vbulletin->userinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password, md5($md5password . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password_utf, md5($md5password_utf . $vbulletin->userinfo['salt']), '')

found that, but still have no clue how they make it, so ican try to reproduce it in c#

Best Regards, Magg

Answer 1

Given the code, formatted (and ignoring this might break the syntax):

    $vbulletin->userinfo['password'] != iif($password AND !$md5password,
        md5(md5($password) . $vbulletin->userinfo['salt']), '')
AND $vbulletin->userinfo['password'] != iif($md5password,
        md5($md5password . $vbulletin->userinfo['salt']), '')
AND $vbulletin->userinfo['password'] != iif($md5password_utf,
        md5($md5password_utf . $vbulletin->userinfo['salt']), '')

This expression detects "failure of all methods", but because I find that hard to read, let's rewrite it as a positive match for "success of any method" by applying De Morgan's with an implicit outside negation:

    $vbulletin->userinfo['password'] == iif($password AND !$md5password,
        md5(md5($password) . $vbulletin->userinfo['salt']), '')
OR  $vbulletin->userinfo['password'] == iif($md5password,
        md5($md5password . $vbulletin->userinfo['salt']), '')
OR  $vbulletin->userinfo['password'] == iif($md5password_utf,
        md5($md5password_utf . $vbulletin->userinfo['salt']), '')

Now, apply simplification and noting and that iff(x,y,z) works like x?y:z we end up with something about like the following in C#:

   storedPW == password && !md5password ? md5(md5(password) + salt) : ''
|| storedPW == md5password ? md5(md5password + salt) : ''
|| storedPw == md5password_utf ? md5(md5password_utf + salt) : ''

The checks are little bit ugly, but .. not my code. The important bit to realize is the pattern is:

 md5(md5(password) + salt) -> storedPw

Unfortunately, this should have matched md5(md5($pass).$salt) from the insidepro link - when using that tool, make sure you're supplying the plain text password and not the hash from the database.

YMMV.

Answer 2

So heres the solution to my problem, finally i managed to get it working.

The problem was that C# uses all strings as unicode, and vbulletin uses all strings as UTF8

For the sake of testing, i created a new form, added a new textbox and a button. This dont connect in anyway to the database, and i provided the salt directly tooken from the database.(for the sake of testing)

Since was already stated vbulleting logins as the following: md5(md5(password)+salt)

So to reproduce the same in C# but using UTF8 heres the solution:

static public string GetMd5Sum(string str)
    {
        //vBulletin uses UTF8 as strings, so you need to pass the user input string as UTF8 also
        Encoder enc = System.Text.Encoding.UTF8.GetEncoder();

        //Create a byte[] array to store the new UTF8 string
        byte[] utf8text = new byte[str.Length];

        //Pass the string to the byte[] array
        enc.GetBytes(str.ToCharArray(), 0, str.Length, utf8text , 0, true);

        //Hash the byte[] array with our UTF8 string inside
        MD5 md5 = new MD5CryptoServiceProvider();
        byte[] result = md5.ComputeHash(utf8text);

        //Build the final string by converting each byte
        //into hex and appending it to a StringBuilder
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < result.Length; i++)
        {
            sb.Append(result[i].ToString("x2")); //x2 here so the outcome result is all in lowercase, couse vbulleting also stores all in lowercase
        }

        //And return it
        return sb.ToString();
    }

    private void button1_Click(object sender, EventArgs e)
    {
        //Get the user input password as plain text
        string pass = textBox1.Text;

        //Here i provided the salt explicit that i took from the database
        string salt = "N1GOt=>8sdO@E54)PH2@NCm5yI#]3u";

        //Here we convert the plain text password into the first hash
        string p1 = GetMd5Sum(pass);

        //Here we add the salt to the previous hashed password
        string p2 = p1 + salt;

        //Here we hash again the previous hashed password + the salt string
        string final = GetMd5Sum(p2);

        //this was just to the test to see if it all works as intended
        MessageBox.Show(final);
    }

This will output the exact same hash stored in the database as password.

Thank you user2246647 for all your help on this problem i had.