Re: mysql password cracking

[Chris Anley <chris () ngssoftware com>]

Hey David,

Re: allowing users to see other user's hashes - it's dangerous; don't do 
it if you don't have to.

To precis what's in the paper (which I wrote btw), there's a few 
interesting points about mysql password hashes:

1) In versions prior to 4.1, the password hash can be used to 
authenticate directly with the database, so you don't need to crack it. 
In other words, knowledge of the *hash* is what the authentication 
protocol tests, not knowledge of the password. Admittedly you'd need to 
modify your mysql client to authenticate this way but that's not too hard.

2) In versions 4.1 or better (which are still Beta) MySQL uses SHA1 to 
hash the passwords, so the situation is a little better. You can still 
crack sha1 password hashes fairly easily though, depending on the 
password complexity and length. The hashing algorithm is to sha1 hash 
the password, then sha1 hash the resulting hash, in other words 
sha1(sha1(password)). Of course, if you're using 4.1 or better you're 
using beta software, against MySQL AB's recommendation.

3) If you use 4.1 ensure it's at least 4.1.3, because of the 
authentication bug detailed in the paper which (briefly) lets any user 
authenticate without needing to know the password.

If for some reason you have to have an untrusted user viewing another 
user's grants, you could do it safely a number of ways (assuming version 
4.0.x):

a) Write a UDF to do it (probably the best solution)
b) Write a batch script that periodically does the 'show grants', strips 
the password hashes out and then inserts the data into a table your user 
can see. Of course, the data won't be current, but that might be ok and 
you don't need to mess about with dangerous privs.
c) Grant the user select privilege (only) on mysql.db, mysql.host, 
tables_priv, user_priv and every column of 'mysql.user' apart from 
'password', and 'select' their privs out manually. This may be 
dangerous, so be careful.

Hope that helps... :o)

     -chris.

Willem Koenings wrote:
> hi,
>
>
> > I'm wondering how dangerous it is to allow a user on a 
> > mysql db to view the grants for another user. Could 
> > they take the encrypted password data and possibly 
> > crack it? If they can, how easy is it? 
>
>
> on certain condition it's quite easy, if you have
> a hash:
>
> test.exe 57510426775c5b0f
> Hash: 57510426775c5b0f
> Trying length 3
> Trying length 4
> Trying length 5
> Found pass: guest
>
>
> some reading for you:
>
> http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
>
> all the best,
>
> W.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html