tomirons / pw-web

This is an open source user/admin panel for the game Perfect World.
28 stars 23 forks source link

Password Encryption #11

Open BahaStriker opened 8 years ago

BahaStriker commented 8 years ago

How can I change the password encryption

I use MD5 but in SQL query it must be edited to remove quotes when inserting password so my auth can read it

BahaStriker commented 8 years ago

My hash is as following

aquireuserpasswd : BEGIN DECLARE passwdtemp VARCHAR(64); START TRANSACTION; SELECT id, passwd INTO uid1, passwdtemp FROM users WHERE name = name1; SELECT fn_varbintohexsubstring(1,passwdtemp,1,0) INTO passwd1; COMMIT; END

and fn_varbintohexsubstring :

BEGIN DECLARE pstrout VARCHAR(4000); DECLARE i int; DECLARE firstnibble int; DECLARE secondnibble int; DECLARE tempint int; DECLARE hexstring char( 16); BEGIN IF( pbinin IS NOT NULL) THEN SET i= 0, cbytesin= CASE WHEN( cbytesin> 0) THEN cbytesin ELSE LENGTH( pbinin) END, pstrout= CASE WHEN( fsetprefix= 1) THEN '0x' ELSE '' END, hexstring= '0123456789abcdef'; IF((( cbytesin * 2) + 2> 4000) or( startoffset< 1)) THEN RETURN NULL; END IF; WHILE( i< cbytesin) DO SET tempint= ASCII( substring( pbinin, i + startoffset, 1)); SET firstnibble= TRUNCATE((tempint / 16),0); SET secondnibble= tempint % 16; SET pstrout= CONCAT(pstrout ,cast( substring( hexstring,( firstnibble+1), 1) AS CHAR), cast( substring( hexstring,( secondnibble+1), 1) AS CHAR)); SET i= i + 1; END WHILE; RETURN pstrout; END IF; RETURN NULL; END; END

BahaStriker commented 8 years ago

Update:

I added BinSalt to Encryption Type in system also in lang but when I register after saving binsalt as encryption method I get this page

`Expression {#394 ▼

value: array:1 [▶]

}`

and this in the page's source

<script> Sfdump = window.Sfdump || (function (doc) { var refStyle = doc.createElement('style'), rxEsc = /([.*+?^${}()|\[\]\/\\])/g, idRx = /\bsf-dump-\d+-ref[012]\w+\b/, keyHint = 0 <= navigator.platform.toUpperCase().indexOf('MAC') ? 'Cmd' : 'Ctrl', addEventListener = function (e, n, cb) { e.addEventListener(n, cb, false); }; (doc.documentElement.firstElementChild || doc.documentElement.children[0]).appendChild(refStyle); if (!doc.addEventListener) { addEventListener = function (element, eventName, callback) { element.attachEvent('on' + eventName, function (e) { e.preventDefault = function () {e.returnValue = false;}; e.target = e.srcElement; callback(e); }); }; } function toggle(a, recursive) { var s = a.nextSibling || {}, oldClass = s.className, arrow, newClass; if ('sf-dump-compact' == oldClass) { arrow = '&#9660;'; newClass = 'sf-dump-expanded'; } else if ('sf-dump-expanded' == oldClass) { arrow = '&#9654;'; newClass = 'sf-dump-compact'; } else { return false; } a.lastChild.innerHTML = arrow; s.className = newClass; if (recursive) { try { a = s.querySelectorAll('.'+oldClass); for (s = 0; s < a.length; ++s) { if (a[s].className !== newClass) { a[s].className = newClass; a[s].previousSibling.lastChild.innerHTML = arrow; } } } catch (e) { } } return true; }; return function (root) { root = doc.getElementById(root); function a(e, f) { addEventListener(root, e, function (e) { if ('A' == e.target.tagName) { f(e.target, e); } else if ('A' == e.target.parentNode.tagName) { f(e.target.parentNode, e); } }); }; function isCtrlKey(e) { return e.ctrlKey || e.metaKey; } addEventListener(root, 'mouseover', function (e) { if ('' != refStyle.innerHTML) { refStyle.innerHTML = ''; } }); a('mouseover', function (a) { if (a = idRx.exec(a.className)) { try { refStyle.innerHTML = 'pre.sf-dump .'+a[0]+'{background-color: #B729D9; color: #FFF !important; border-radius: 2px}'; } catch (e) { } } }); a('click', function (a, e) { if (/\bsf-dump-toggle\b/.test(a.className)) { e.preventDefault(); if (!toggle(a, isCtrlKey(e))) { var r = doc.getElementById(a.getAttribute('href').substr(1)), s = r.previousSibling, f = r.parentNode, t = a.parentNode; t.replaceChild(r, a); f.replaceChild(a, s); t.insertBefore(s, r); f = f.firstChild.nodeValue.match(indentRx); t = t.firstChild.nodeValue.match(indentRx); if (f && t && f[0] !== t[0]) { r.innerHTML = r.innerHTML.replace(new RegExp('^'+f[0].replace(rxEsc, '\\$1'), 'mg'), t[0]); } if ('sf-dump-compact' == r.className) { toggle(s, isCtrlKey(e)); } } if (doc.getSelection) { try { doc.getSelection().removeAllRanges(); } catch (e) { doc.getSelection().empty(); } } else { doc.selection.empty(); } } }); var indentRx = new RegExp('^('+(root.getAttribute('data-indent-pad') || ' ').replace(rxEsc, '\\$1')+')+', 'm'), elt = root.getElementsByTagName('A'), len = elt.length, i = 0, t = []; while (i < len) t.push(elt[i++]); elt = root.getElementsByTagName('SAMP'); len = elt.length; i = 0; while (i < len) t.push(elt[i++]); root = t; len = t.length; i = t = 0; while (i < len) { elt = root[i]; if ("SAMP" == elt.tagName) { elt.className = "sf-dump-expanded"; a = elt.previousSibling || {}; if ('A' != a.tagName) { a = doc.createElement('A'); a.className = 'sf-dump-ref'; elt.parentNode.insertBefore(a, elt); } else { a.innerHTML += ' '; } a.title = (a.title ? a.title+'\n[' : '[')+keyHint+'+click] Expand all children'; a.innerHTML += '<span>&#9660;</span>'; a.className += ' sf-dump-toggle'; if ('sf-dump' != elt.parentNode.className) { toggle(a); } } else if ("sf-dump-ref" == elt.className && (a = elt.getAttribute('href'))) { a = a.substr(1); elt.className += ' '+a; if (/[\[{]$/.test(elt.previousSibling.nodeValue)) { a = a != elt.nextSibling.id && doc.getElementById(a); try { t = a.nextSibling; elt.appendChild(a); t.parentNode.insertBefore(a, t); if (/^[@#]/.test(elt.innerHTML)) { elt.innerHTML += ' <span>&#9654;</span>'; } else { elt.innerHTML = '<span>&#9654;</span>'; elt.className = 'sf-dump-ref'; } elt.className += ' sf-dump-toggle'; } catch (e) { if ('&' == elt.innerHTML.charAt(0)) { elt.innerHTML = '&#8230;'; elt.className = 'sf-dump-ref'; } } } } ++i; } }; })(document); </script> <style> pre.sf-dump { display: block; white-space: pre; padding: 5px; } pre.sf-dump span { display: inline; } pre.sf-dump .sf-dump-compact { display: none; } pre.sf-dump abbr { text-decoration: none; border: none; cursor: help; } pre.sf-dump a { text-decoration: none; cursor: pointer; border: 0; outline: none; }pre.sf-dump{background-color:#fff; color:#222; line-height:1.2em; font-weight:normal; font:12px Monaco, Consolas, monospace; word-wrap: break-word; white-space: pre-wrap; position:relative; z-index:100000}pre.sf-dump .sf-dump-num{color:#a71d5d}pre.sf-dump .sf-dump-const{color:#795da3}pre.sf-dump .sf-dump-str{color:#df5000}pre.sf-dump .sf-dump-cchr{color:#222}pre.sf-dump .sf-dump-note{color:#a71d5d}pre.sf-dump .sf-dump-ref{color:#a0a0a0}pre.sf-dump .sf-dump-public{color:#795da3}pre.sf-dump .sf-dump-protected{color:#795da3}pre.sf-dump .sf-dump-private{color:#795da3}pre.sf-dump .sf-dump-meta{color:#b729d9}pre.sf-dump .sf-dump-key{color:#df5000}pre.sf-dump .sf-dump-index{color:#a71d5d}</style><pre class=sf-dump id=sf-dump-1481468843 data-indent-pad="  "><abbr title="Illuminate\Database\Query\Expression" class=sf-dump-note>Expression</abbr> {<a class=sf-dump-ref>#394</a><samp>
  #<span class=sf-dump-protected title="Protected property">value</span>: <span class=sf-dump-note>array:1</span> [<samp>
    <span class=sf-dump-index>0</span> => {<a class=sf-dump-ref>#395</a><samp>
      +"<span class=sf-dump-public title="Runtime added dynamic property">fn_varbintohexsubstring ( 1, ?, 1, 0 )</span>": "<span class=sf-dump-str title="34 characters">0x676f6c64737461723234313935393234</span>"
    </samp>}
  </samp>]
</samp>}
</pre><script>Sfdump("sf-dump-1481468843")</script>
tomirons commented 8 years ago

@BahaStriker That's because BinSalt isn't supported yet, we haven't found a way to get it working. If you want to get it working be our guest, and we'll update the source with the fix.

BahaStriker commented 8 years ago

I'm trying already, I will send results later

tomirons commented 8 years ago

To mess around with the BinSalt encryption, you need to look at app/Hash/BinSaltHasher and ONLY worry about the make function.

BahaStriker commented 8 years ago

Yes I'm aware

tomirons commented 8 years ago

I don't know if your familiar with Laravel or not, that's why I was telling you.