ivanov-md5的网络上的实现.txt

md5加密算法

最近，有一些朋友问我一些软件爆破后怎么还出现限制。我看了很多这类的软件80%是使用MD5来防护的，国外的软件使用率更高。
我现在说一说主流的应用方式，十个MD5中有九个是这样应用的。
程序开篇就读注册表。
当我们输入一个刺探码时，程序会先一步把它写入注册表，不做变形，明码的，在过去这样的程序一般都是明码比较的， 但现在遇到这样的方式一般都是MD5. 

作者在程序中预置了一个目录表，例如，21e47838e747ae8f380b253f0d8603f8； ...... 这类的密码串。

你的刺探码经过程序上MD5算法的加密也得到一个同样长度的密码串，然后拿这个密码串与预置目录中的进行比较，完全对应了就提示正确，不对应就提示出错。并且有多个相同的预置目录表散放在程序的各处，每执行到关键部分它就开始读注册表，进行加密和比较。很多的Cracker遇到这种MD5的加密方式都不知如何下手。其实了解了它的加密流程，就会发现它有一个致命的缺点，预置表就是它的软肋，只要把刺探码的对应MD5密码串植入预置表即可。
所以现今一发现有上述注册表操作的软件，就应首先怀疑它是MD5防护的（过一段时间就不一定了）。

如果把这种加密方式放在网络效验软件注册上就不好办了，我的P.C.L.s.G研究小组正在进行这方面探讨，我希望这种方式将来能成为主流，下面我贴一个MD5的PHP实现（这是PHP小组定期发来的，所有的提及名字为PHP成员，而非P.C.L.s.G  ：））。

md5 add a note
+h+a+g+m+a+n+ at +h+o+t+b+r+e+v+ dot +c+o+m+
22-Jun-2003 10:05 
One char md5 bruteforce

function md5_bruteforce($md5_str)
{
 for ($i = 0; $i < 256; ++$i) {
      if ($md5_str == md5(chr($i))) {
          return chr($i);
      }
  }
 return false;
}
hkmaly at matfyz dot cz
20-Jun-2003 10:11 
You can use md5 (or other hash function) with xor even for symetric crypting and decrypting.

Michael Siroskey
19-Jun-2003 04:39 
The problem experienced by “lee at fallingforward dot net” was probably caused by using double quotes around the variable in Perl.  If double quotes are used (“$pa$$”) then Perl interprets syntax symbols ($, @) as variables for lookup.  In this case $$ will display the current pid for the running Perl process and not ‘$$’.  To prevent this from happening you either need to escape syntax symbols or you can use single quotes (‘$pa$$') to prevent it from doing variable lookup.  

# Incorrect Code
#--------------------------------------
$string = "pa$$";
require Digest::MD5;
$md5 = Digest::MD5->new;
$md5->add($string);
$digest = $md5->hexdigest;
print $digest,"\n";

# Correct Code
#--------------------------------------
$string = ‘pa$$’;
require Digest::MD5;
$md5 = Digest::MD5->new;
$md5->add($string);
$digest = $md5->hexdigest;
print $digest,"\n";

Hope this helps.

Michael Siroskey
Developer @ 2Checkout.com
Dream Master
28-May-2003 04:21 
I solved the problem....

Here is a link to my post on phpbb.com about a problem I was having with my perl script md5 encoding my data from within perl....

http://www.phpbb.com/phpBB/viewtopic.php?t=105334

Hope this helps someone...

----

Here's a copy just incase its removed from the phpbb.com site by the time you read this....

---CUT----

Posted: Wed May 28, 2003 3:09 am    Post subject: How to interface Perl with PHP's MD5 Password Encryption

Problem: Perl crypt and Php's use of MD5 are not compatible.

Encryption is more secure in MD5 as it is a ramdom set of 0-9 and a-f hashs in 64bits no matter what the length or text of the password. Perl's standard crypt cannot do this.

Solution: Within your perl script, just before the lines you are setting to write the password, you need to enter the following code.

Note: I tried this one Perl 5.006001 so it may not work on older versions.

--CLIP--

#load the MD5 Digest.
use Digest::MD5 qw(md5_hex);

#set your text databse variables to a single string for md5 conversion
#remember to change $database_array[1]; to your own variable.
$password = $database_array[1];

#generate yet another new string, this one is the converted database_array
#note the use of md5_hex

$newpassword = md5_hex($password);

#Send the $newpassword to your PHP SQL table and your set!

--CLIP--
I hope this helps out alot of people... from what I've read about this, no one else on the net could break this code... All it took was a little research, and brain work...

I am interested in your thoughts and comments on this... so please reply!!!

Good luck modding!!!
_________________
Dream Master
paj at pajhome dot org dot uk
21-May-2003 04:20 
Hi,

You can use the MD5 function in combination with a similar javascript function to protect user passwords for logins. The arrangement goes like this:

When the user requests the login page, the server generates a random number. It stores this in a session variable as well as sending to the client.

When the user clicks submit, javascript in the client computes md5(password + random).

The server can also generate this hash, because it already knows the password and random number. It uses this to check that the user entered the correct password.

The password has not been transmitted in the clear, and next login the random number will be different, so an attacker can't use a "replay attack".


Paul
Shane Allen
14-Apr-2003 09:53 
From the documentation on Digest::MD5:
md5($data,...)
This function will concatenate all arguments, calculate the MD5 digest of this "message", and return it in binary form.

md5_hex($data,...)
Same as md5(), but will return the digest in hexadecimal form.

PHP's function returns the digest in hexadecimal form, so my guess is that you're using md5() instead of md5_hex(). I have verified that md5_hex() generates the same string as PHP's md5() function.

(original comment snipped in various places)
>Hexidecimal hashes generated with Perl's Digest::MD5 module WILL
>NOT equal hashes generated with php's md5() function if the input
>text contains any non-alphanumeric characters.
>
>$phphash = md5('pa$$');
>echo "php original hash from text: $phphash";
>echo "md5 hash from perl: " . $myrow['password'];
>
>outputs:
>
>php original hash from text: 0aed5d740d7fab4201e885019a36eace
>hash from perl: c18c9c57cb3658a50de06491a70b75cd
lee at fallingforward dot net
07-Apr-2003 01:01 
There is an extremely frusturating incompatibility between php and Perl's md5() and crypt() functions. I hope someone can prove me wrong on this, because I'm having trouble finding any writing on the internet about it, yet it seems like a big problem.

Hexidecimal hashes generated with Perl's Digest::MD5 module WILL NOT equal hashes generated with php's md5() function if the input text contains any non-alphanumeric characters.

Example:

the correct password is "pa$$"

$hash = md5($password);
$phphash = md5('pa$$');

echo "plaintext password from user input: $password";
echo "hash from textfield: $hash";
echo "php original hash from text: $phphash";
echo "md5 hash from perl: " . $myrow['password'];

outputs:

plaintext password: pa$$
hash from textfield: 0aed5d740d7fab4201e885019a36eace
php original hash from text: 0aed5d740d7fab4201e885019a36eace
hash from perl: c18c9c57cb3658a50de06491a70b75cd
dmarsh dot no dot spam dot please at spscc dot ctc dot edu
02-Dec-2002 03:27 
Recommended readed: OpenSSL from O'reilly! It has chapters on SSL and PHP!! but it also covers cryptography in more depth (chapters 1 and 2 are highly recommended to all here!). It has lots of good information! Talks in depth about lots of stuff that I cannot begin to explain here.

MD5 is a repeatable hashes / digest process. Taking something of unknown size or content and reducing it to a known size but retaining a high degree of unknown content. A good hash / digest is said to alter the output significantly
changing ~50% of the bits in the "fixed-in-size" output stream) in the event of changing one bit (at random) from the "unknown-in-size" input stream (or even changing the length of the input stream by one bit*/byte, *=with padding if necessary)

MD5 is such a hash / digest. Other than that, it doesn't do much on it's own.

MD5 is a cheap way to test a file transfer (like a CRC32). If either the file or the MD5 is downloaded with errors, the chances that the MD5 of the file and the "PUBLIC" copy of the MD5 will match is highly unlikely. Both would have to error in a highly unpredictable way. However relying of MD5s as a way to validate that the file hasn't been tamptered with (tainted) is not good. If you can download the file from one place and a public MD5 from a second place, you at least are using a 3rd party method to attempt to validate the file's contents against tainting.

MD5 can ONLY be used to validate the contents against tainting if there is something secret (private) between the two end-points.

Lets examine MD5 in a typical and extremely effective email validating process. The two parties via a trusted method exchange a word / phrase / password (something private) that hopefully nobody else knows.

The first party publically composes an email with an MD5. But instead of sending that MD5. the MD5 is used against this word / phrase / password (private) in a Message Authentication Code (MAC), or better Hash-MAC (HMAC) 

One way would be to MD5 the word / phrase / password (private) part and the public part (the message body) as two different MD5's. the MD5 the two MD5s together as a single MD5 and send the composite MD5 in the public.

The receiver can (using all available parts, the private part, public part and the composite MD5) authenicate (testing against the computed part) the message hasn't been tampered during transit. The message body and the composite MD5 is sent in plain text, yet the contents have been authenicated with a high level of confidence. No encryption was used.

MD5 is often used to authenicate parts of encrypted streams and thus is the reason why many confuse MD5 as encryption (or even authenication) rather than what it is. A hash / digest.

An alternate to MD5 is SHA1. The output size of SHA1 is a little bigger (I think 164bits). More bits, means a higher degree of complexity. 128 bits is concidered minimim by experts in the field.... For cipher lengths and symmetric key sizes (due to computational power now available for brute force attacks).

--Doug
jason dot garber at vosystems dot biz
23-Oct-2002 12:46 
Just a quick note - To generate a random color for a webpage, use this

substr(md5(microtime()), 0, 6)

It will return a 6 char hex color.

-J
karlos dot gustavo at terra dot com dot br
30-Sep-2002 10:09 
simple slappaswd MD5 hash generation:

$ldap_passwd = "{md5}".base64_encode(pack("H*",md5($password)));
calin at ciao dot com
21-May-2002 07:01 
Hi everybody,

A way of partially securing your script so that a username/password combination is not visible immediatelly is to use the one-way-only encryption of md5. For example, using HTTP Authentication with PHP in this way:

if (
md5($PHP_AUTH_USER) !='21232f297a57a5a743894a0e4a801fc5' ||
md5($PHP_AUTH_PW) !='f70d11f8ad83b6f913115426098d2712'
) {
// force authentication
.....
exit;
}
could help you to protect the actual username and password from a person that can read the PHP script.

Calin Uioreanu
php9 Weblog
http://www.php9.com
mbabcock-php at fibrespeed dot net
27-Jun-2001 03:06 
I must point out to all the people who read the notes this far that MD5 is _not_ encryption in a traditional sense.  Creating an MD5 digest (or hash) of a message simply creates 128 bits that can be used to almost positively identify that message or object in the future.  You use MD5 if you want to validate that information is true.  For example, you may ask a user to submit a message through a browser POST and save an MD5 of that message in a database for a preview function.  When the user submits it the second time, running the MD5 hash of the new version of the text and comparing it to the original MD5 in the database will tell you if the text has changed at all.  This is how MD5 is used -- it is _not_ for encrypting things so as to get the data back afterward -- the MD5 hash version does _not_ contain the data of the original in a new form.