Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have inherited a PhpBB3 installation from an uncontactable previous admin who didn't leave me the password, or any mechanism to retrieve it.

It runs on a MySQL database, which I have logged into with full privileges in order to change the admin password. Unfortunately, PhpBB3 apparently uses a complex multistage salted hashing technique that I'm not familiar with. Given full access to the DB, how do I generate a valid password hash to replace the old one with?

I tried a simple MD5 of the known password of a normal user, and it doesn't match the DB entry.

Any other way to reset the admin password via the DB is also helpful, as long as it works!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

run mysql and select the relevant database then use the MD5 function to set the password on the account that you want to change.

For example if your phpbb3 database is called Yourphpbb3db and the users table is phpbb_users then

mysql -u root -p

enter your password

mysql> show databases;
mysql> use database Yourphpbb3db;
Database changed
mysql> UPDATE phpbb_users SET user_password = MD5('YourPassword') WHERE username='YourAdminName';
share|improve this answer
    
I already tried this, as mentioned in my question. PhpBB has moved to a more complicated multistage salted hashing technique in version 3, so this doesn't work :( –  Captain Blammo Nov 24 '10 at 21:32
    
Before I posted my answer I tried it on a copy of a phpbb3 system I use for testing. Worked for me. –  Iain Nov 24 '10 at 21:36
    
Well damn, it isn't the same hash, but it doesn't complain, then sets it to another one I can't reproduce as soon as I login. Thanks! Do you want to edit your answer to mention that, or shall I edit my question to not mention it? I didn't insert the MD5 hash because I could tell it didn't match. –  Captain Blammo Nov 24 '10 at 21:59
2  
I just checked the source code. If a password is stored with the initial characters $H$ then it's in the new format and dealt with as such. If it's not in the new format then after being verified using the old methods it is silently converted to the new format. –  Iain Nov 24 '10 at 22:18

I'm only slightly familiar with the intricacies of phpBB3, but I would try copying the hash and salt from another user account where the password is known (a throwaway account for this purpose or somesuch). Of course, back up the current hash and salt first, or possibly the whole DB... if that doesn't work, I would try elevating another account's privileges. I'm completely unfamiliar with the privilege system in phpBB3, but you can either try to duplicate the current admin's privilege table entries for a new account or just replace the admin's user ID with a known account. I would do all of this on a test system, if possible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.