[SOLVED]- FOUND OTHER DOCUMENTATION Encrypting a password to MD5

[jaffinito43]

So I have a password file where users passwords are stored as the MD5 hash of "changeme"..(4cb9c8a8048fd02294477fcb1a41191a)... My script, which asks for the username and password, accepts the password as plain text but I have no idea how to calculate the MD5 hash to compare it to the password file. It seems like it's too complicated to try to write an algorithm for so does anyone know of any ideas? Thanks!

# CSC 310 Project # 3

#opening passwd file
open (PSWD, '<', 'passwd.txt');

#getting username and password
#converting username to lowercase if anything is entered in CAPS
print "Please enter your username: ";
chomp($userN = <STDIN>);
$username = lc($userN);
print "Please enter your password: ";

#hiding password 
system ("stty -echo");
chomp($passwd = <STDIN>);

$matchCount = 1;
#reading passwd.txt and assigning values
while ($lines = <PSWD>){
    ($user,$pswd,$userID,$groupID,$info,$home,$shell) = split ':', $li
+nes;

    #checking username entered vs that in the passwd file
    if ($username eq $user){
    print "\nChecking username... MATCH\n";
    
    #keeps track if username matches or not
    $matchCount += 1;
    
    #checking password entered vs that in the passwd file
    if ($passwd eq $pswd){
        print "Checking password... MATCH\n\n";
        $matchCount -= 2;
    }
    else{
        print "Password does not match!\n";
    }
     last;
    }
}

# if matchcount did not change, username did not match killing the pro
+gram
if ($matchCount != 0){
    die ("\nEither the username or password did not match.\n");
}


......

Right now, the script checks the plain text of the file (I changed the passwords stored in the password file) and works great, but the MD5 hash is going to throw me off. Any help is appreciated.

[davido]

Digest::MD5 (A core module). The security of the MD5 hash function is severely compromised.

Prefer alternatives such as Digest::Bcrypt, or Digest::SHA (using SHA-2). Authen::Passphrase is a nice tool that provides easy access to various safe alternatives (as well as some less secure alternatives).

Anyway, you've marked this [SOLVED], but might want to re-think it.

[zentara]

Is your problem solved? You never did show the code that solved your problem. If not, see encryption confusion, you need to get the salt values, on linux it is in /etc/shadow.

This super simple example shows the basics:

#!/usr/bin/perl
use warnings;
use strict;

print "Standard crypt output\n";
print crypt("password","sa"), "\n";

#glibc's implementation  that takes  care of  this.  Since  perl on
# Linux uses glibc, you get this automagically. When the salt looks li
+ke
# $1$...., it will encrypt the password using MD5.  e.g.


print "MD5 crypt output\n"; 
print crypt("password","\$1the_salt\$"), "\n";


print "SHA crypt output\n"; 
print crypt("password","\$2the_salt\$"), "\n";