How to get the same result from MD5 & base64_encode - php

Question

Ok so here's my problem, I am trying to use information from my database to create a change password script for a secondary account. However the password for the main account is hashed in md5. No matter what I try I cannot get the base64/md5 code to match up when doing a comparison.
This is the code I use to enter the information into the database for the second account.
$nametrim = StrToLower(Trim($ya_username));
$pwdtrim = StrToLower(Trim($user_password));
$Salt = base64_encode(md5($nametrim.$pwdtrim, true));
$result2 = $db->sql_query("call adduser('$nametrim', '$Salt', '0', '0', '0', '$rmad', '$ya_user_email', '0', '0', '0', '0', '0', '0', '0', '', '', '$Salt')") or die ("Can't execute query.");
The main account and secondary account register fine, no problems there, the problem comes with my change password script when trying to recreate the base64 code.
$unametrim = StrToLower(Trim($uname));
$unamemd5 = md5($unametrim);
$Salt1 = base64_encode($unamemd5.$upass);
I should note that $upass is already in MD5 when pulled from the database, hence the reason I only MD5'd the username. No matter what I try I cannot get them to match at all.
Here is the rest of my change password page as a reference, hopefully someone can help me with this problem.
<?php
/****************************************************************************/
/* Generated by Module Creator - By Disipal Designs (www.disipal.net) */
/* PHP-Nuke Tools v4.00 */
/****************************************************************************/
if (!defined('MODULE_FILE')) {
die ("You can't access this file directly...");
}
require_once("mainfile.php");
$module_name = basename(dirname(__FILE__));
get_lang($module_name);
include("header.php");
define('INDEX_FILE', true);
global $userinfo, $db;
$fname=substr(strrchr($_SERVER['PHP_SELF'],'/'), -(strlen(strrchr($_SERVER['PHP_SELF'],'/')) -1));
$uname = $userinfo['username'];
$upass = $userinfo['user_password'];
$unametrim = StrToLower(Trim($uname));
$unamemd5 = md5($unametrim);
$Salt1 = base64_encode($unamemd5.$upass);
$result = $db->sql_query("SELECT * FROM users WHERE name='$unametrim'") or ("Can't execute query.");
$row = $db->sql_fetchrow($result);
$uid = $row['ID'];
$aname = $row['name'];
$passwd = $row['passwd'];
$passwd2 = $row['passwd2'];
$ipno = $row['idnumber'];
$rmad = $_SERVER['REMOTE_ADDR'];
OpenTable();
echo "<p align='center'><b><u>Change Game Account Password</u></b></p>";
if (isset($_POST['upass'])) {
$funame=$_POST['uname'];
$fpasswd=$_POST['pass1'];
$fpasswd2=$_POST['pass2'];
$fupass=$_POST['upass'];
$encryptpass = md5($fupass);
$encryptpasswd = md5($fpasswd);
$encryptpasswd2 = md5($fpasswd2);
$nametrim = StrToLower(Trim($funame));
$pwdtrim = StrToLower(Trim($fupass));
$Salt = base64_encode(md5($nametrim.$pwdtrim, true));
if ($fpasswd == $fpasswd2) {
$db->sql_query("CALL changePasswd ($result->quoteSmart'$nametrim', '$Salt')");
$db->sql_query("CALL changePasswd2 ($result->quoteSmart'$nametrim', '$Salt')");
echo "<p align=\"center\"><b>Game account password has been changed successfully</b></p>";
echo "<form method=\"POST\" action=\"modules.php?name=Change_PW\"><p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Continue\"></p></form>";
}
}
if (isset($_POST['passwd1'])) {
$funame=$_POST['uname'];
$fpasswd=$_POST['passwd1'];
$fpasswd2=$_POST['passwd2'];
$fupass=$_POST['upass'];
$encryptpass1 = md5($fupass);
$encryptpasswd = md5($fpasswd);
$encryptpasswd2 = md5($fpasswd2);
$nametrim = StrToLower(Trim($funame));
$pwdtrim = StrToLower(Trim($fpasswd));
$Salt = base64_encode(md5($nametrim.$pwdtrim, true));
if (empty($fpasswd) || empty($fpasswd2)){
echo "<p align=\"center\"><b>You cannot leave the password field blank</b></p>";
echo "<form method=\"POST\" action=\"modules.php?name=Change_PW\"><p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Continue\"></p></form>";
} else {
if ($encryptpasswd == $encryptpasswd2) {
$db->sql_query("CALL changePasswd ($result->quoteSmart'$nametrim', '$Salt')");
$db->sql_query("CALL changePasswd2 ($result->quoteSmart'$nametrim', '$Salt')");
echo "<p align=\"center\"><b>Game account password has been changed successfully</b></p>";
echo "<form method=\"POST\" action=\"modules.php?name=Change_PW\"><p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Continue\"></p></form>";
} else {
echo "<p align=\"center\"><b>Passwords did not match, please try again</b></p>";
echo "<form method=\"POST\" action=\"modules.php?name=Change_PW\"><p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Continue\"></p></form>";
}
}
}
if (isset($_POST['upass']) || isset($_POST['passwd1'])) {
} else {
if ($passwd != $Salt1) {
echo "<p align=\"center\"><b>Your game account password does not match your web account.</b><br>Update game account password to match web account?</p>";
echo "<p align=\"center\"><form method=\"POST\" action=\"modules.php?name=Change_PW\">
<input type=\"hidden\" name=\"uname\" value=\"".$uname."\">
<input type=\"hidden\" name=\"upass\" value=\"".$upass."\">
<input type=\"hidden\" name=\"pass1\" value=\"".$passwd."\">
<input type=\"hidden\" name=\"pass2\" value=\"".$passwd2."\">
<p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Update Password\"></p>
</form></p>";
} else {
if (isset($_POST['passwd1'])) {
echo "<form method=\"POST\" action=\"modules.php?name=Change_PW\"><p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Continue\"></p>";
} else {
echo "<p align=\"center\"><form method=\"POST\" action=\"modules.php?name=Change_PW\">
<input type=\"hidden\" name=\"uname\" value=\"".$uname."\">
<p align=\"center\">New Password:<br><input type=\"password\" name=\"passwd1\"\"></p>
<p align=\"center\">Confirm Password:<br><input type=\"password\" name=\"passwd2\"\"></p>
<p align=\"center\"><input type=\"submit\" name=\"submit\" value=\"Change Password\"></p>
</form></p>";
}
}
}
echo "Test Area<br>Salt: $Salt1<br>Passwd: $passwd<br>unametrim: $unametrim<br>unamemd5: $unamemd5<br>upass: $upass";
CloseTable();
include("footer.php");
?>
Any ideas on what I can do here, been working on this for ages and haven't been able to figure out how to get it working properly.

Answer 1

It looks like you will need to rethink your entire approach to whatever it is you are actually trying to accomplish, because what you appear to be attempting to do is fundamentally impossible due to the nature of MD5 or any cryptographic hash function.
When you only have a cryptographic hash of a value and not the original value, it's impossible, for all practical purposes, to do anything further with the value.
I should note that $upass is already in MD5 when pulled from the database, hence the reason I only MD5'd the username. No matter what I try I cannot get them to match at all.
That's be cause there's nothing meaningful that you can combine with md5('foo') to get the same result as md5('foobar'). Hashes can't be concatenated, just like they can't be reversed.
md5('foo') = acbd18db4cc2f85cedef654fccc4a4d8
md5('bar') = 37b51d194a7513e45b56f6524f2d51f2
md5('foobar') = 3858f62230ac3c915f300c664312c63f
You don't show the code where the salt value is actually or where in the database it is stored, but it presumably has to be stored somewhere or it would be rather pointless to have assuming it's a salt in the usual sense... so the thing for you to do would be to simply fetch and reuse it, because it's impossible to regenerate it if you don't have the plain-text version of the password in hand.
Of course, the fact that there's a salt in here somewhere suggests that the password may not even be what's represented in the md5 value you think is the password. The point of a salt is that you store an md5 of (thing you want to secure + salt) so that if you have a security breach, then the thing you stored isn't easily looked up in a table like the one this site has. (They aren't "decoding" MD5 -- that's impossible. They have tables of hashes and the values that generated those hashes. The three md5 values I used as examples are terrible passwords, of course, but that site has those three in its lookup tables already... passwords stored as MD5 without a salt are much more easily cracked).
The only other option I see that you have, after asking the user if they want to change one password to the other would be to actually require that they "confirm" their main password, which gives you a chance to get your hands on the plain-text version of the password, which you should, of course, validate as authentic before acting on it.