user3022598 user3022598 - 1 month ago 21
MySQL Question

How to decrypt password from mysql php

What i would like to do is have a php page that when a server is selected from a dropdown list a text box will show up with a "Show Password" button.

At my last company we used epicor which had a handy feature that when you selected a server you had an option to see the server password in plain text.

When you looked at the epicor database for that password it was either encrypted or hashed, im not sure which.

I run about 20 server at the moment and will be adding more as time goes by.


  1. Am I encrypting? Is there a reversible encryption I can use?

  2. What php function would I use to read the encrypted password?



I have read that hashing a password will not do what I want.

Googleing is not getting me the info I need and Im starting from scratch for the most part.

Question/Concern 1: If the password is encrypted (not hashed) and someone steals a copy of the database backup (idk somehow, use you imagination) would they be able to decrypt the passwords?

I am assuming I would need to have some soft of SSL or handshake or something to tell the database that my application is able to decrypt and read the password?

Question/Concern 2: Could someone access the server locally and be able to decrypt them? I am assuming Yes.

Here is some of the code I have so far:

The form:

<form name="registration" action="passset.php" method="post">
<?php
$conn = new mysqli('', '', '', '')
or die ('Cannot connect to db');

$result = $conn->query("select id, server from servertbl where owner ='me'");
echo "<tr><td>Server Name: </td><td><select name='server'>";
while ($row = $result->fetch_assoc()) {
echo '<option value="' . $row["id"] . '">' . $row["server"] . '</option>';
}
echo "</select></td></tr>";
?>

<input type="password" name="password" placeholder="Password" required />
<!-- Here is where it gets hairy what to put here to be able to read the password.-->

<input type="button" name="showpass" />


<input type="submit" name="submit" />
</form>


The submit

<?php
$servername = "";
$username = "";
$password = "";
$dbname = "";

$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}


$server = $_POST["server"];
$password = stripslashes($_POST['password']);
$password = mysqli_real_escape_string($conn,$password);
$result1 = $conn->query("SELECT svrid, server FROM servertbl where id ='$server'");
$row1 = $result1->fetch_assoc();
$svrid = $row1["svrid"];
$server1 = $row1["server"];

$sql = "INSERT INTO passwords (svrid, server, password) VALUES ('$svrid', '$server1', '".crypt($password)."')";
$result = mysqli_query($con,$query);

if (mysqli_query($conn, $sql)) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

mysqli_close($conn);
?>


An the database looks like so:

MariaDB [problemsdb]> select * from passwords;
+--------+---------+------------------------------------+
| svrid | server | password |
+--------+---------+------------------------------------+
| 486225 | server2 | $1$GUJwTavi$DL1ktZqzyInLLl5hcDs2i1 |
+--------+---------+------------------------------------+
1 rows in set (0.00 sec)

Answer

crypt() will return a hashed string using the standard Unix DES-based algorithm or alternative algorithms that may be available on the system.

The salt parameter is optional. However, crypt() creates a weak password without the salt. PHP 5.6 or later raise an E_NOTICE error without it. Make sure to specify a strong enough salt for better security.

password_hash() uses a strong hash, generates a strong salt, and applies proper rounds automatically. password_hash() is a simple crypt() wrapper and compatible with existing password hashes. Use of password_hash() is encouraged.

Some operating systems support more than one type of hash. In fact, sometimes the standard DES-based algorithm is replaced by an MD5-based algorithm. The hash type is triggered by the salt argument. Prior to 5.3, PHP would determine the available algorithms at install-time based on the system's crypt(). If no salt is provided, PHP will auto-generate either a standard two character (DES) salt, or a twelve character (MD5), depending on the availability of MD5 crypt(). PHP sets a constant named CRYPT_SALT_LENGTH which indicates the longest valid salt allowed by the available hashes.

The standard DES-based crypt() returns the salt as the first two characters of the output. It also only uses the first eight characters of str, so longer strings that start with the same eight characters will generate the same result (when the same salt is used).

Example

<?php
$hashed_password = crypt('mypassword'); // let the salt be automatically generated

/* You should pass the entire results of crypt() as the salt for comparing a
   password, to avoid problems when different hashing algorithms are used. (As
   it says above, standard DES-based password hashing uses a 2-character salt,
   but MD5-based hashing uses 12.) */
if (hash_equals($hashed_password, crypt($user_input, $hashed_password))) {
   echo "Password verified!";
}
?>

REf: http://php.net/manual/en/function.crypt.php