View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0004228unrealircdpublic2013-07-26 23:532013-08-02 01:30
ReporterTechman Assigned To 
PriorityhighSeveritymajorReproducibilityalways
Status closedResolutionunable to duplicate 
Product Version3.2.10.1 
Summary0004228: Making hashed passwords for oper blocks that contains special characters don't work when tried in an IRC client
DescriptionRunning ./unreal mkpassword sha1 <pass here that includes special characters> or /quote mkpasswd sha1 <pass here> generates a hash, but the original password won't work when tried after a rehashing.
Steps To Reproduce1. Generate a hashed password using sha1 that includes special characters (I tested $ specifically)
2. Paste the hashed password in the config file correctly with the sha1 piece added
3. Rehash
4. Try to oper up in a IRC Client. The password that you hashed won't work.
Additional InformationWhen using a normal letter/number password, encryption works fine.
3rd party modules

Activities

n0kS

2013-07-26 23:58

reporter   ~0017725

As a note, I tried a sha1 pass as well including special chars like $ or # in the password and it didn't work for me either.

ohnobinki

2013-07-27 05:10

reporter   ~0017726

Running this moment’s tip ( http://hg.unrealircd.org/hg/unreal/rev/4bcae28498b4 ),

$ ~/unreal-hg/unreal mkpasswd sha1 as\$lksdjf
Encrypted password is: $M30/OiIf$E+oa2a7Cn6ZvZ2FAqLJZIRsWitk=

that can be used to authenticate as oper with “as$lksdjf”:

OPER binki :as$lksdjf
:binki MODE binki :+oghaAN


Please give 1. some example passwords that break with unrealircd-3.2.10.1 (which should be equivalent to tip here) and 2. the exact shell commands and output you use to create your password.

bekarfel

2013-07-27 11:11

reporter   ~0017727

using
Unreal3.2.10.1. dread.faproot.com FhinWXeOoZE [Microsoft Windows 7 Service Pack 1 (build 7601)=2311]
-dread.faproot.com- OpenSSL 1.0.1c 10 May 2012
-dread.faproot.com- zlib 1.2.7
-dread.faproot.com- libcurl/7.28.0

I am unable to reproduce this. I have used the following five test cases:

-> Server: mkpasswd sha1 :$43457ergasega4
-dread.faproot.com- *** Authentication phrase (method=sha1, para=$43457ergasega4) is: $7Wn4whpC$xREad5LJbU3FvZjee7jWVdGb0Qc=
382: unrealircd.conf Rehashing
*** BekarfelACER sets usermode: -oghaANW
-> Server: oper Dreadnought $43457ergasega4
*** BekarfelACER sets usermode: +oghaANW
381: You are now an IRC Operator

-> Server: mkpasswd sha1 :2342376790$$3422345sdfg
-dread.faproot.com- *** Authentication phrase (method=sha1, para=2342376790$$3422345sdfg) is: $f56yu9gV$dupMnX//1gX9eU/G2z6WWGjd6Mw=
382: unrealircd.conf Rehashing
*** BekarfelACER sets usermode: -oghaANW
-> Server: oper Dreadnought 2342376790$$3422345sdfg
*** BekarfelACER sets usermode: +oghaANW
381: You are now an IRC Operator

-> Server: mkpasswd sha1 :331126rwdfh312435$#RTT
-dread.faproot.com- *** Authentication phrase (method=sha1, para=331126rwdfh312435$#RTT) is: $2GjLqy7O$BNhg/VHZ8p0S/FDBJJN8TMSMT0I=
382: unrealircd.conf Rehashing
*** BekarfelACER sets usermode: -oghaANW
-> Server: oper Dreadnought 331126rwdfh312435$#RTT
*** BekarfelACER sets usermode: +oghaANW
381: You are now an IRC Operator

-> Server: mkpasswd sha1 :$$$$$$$$$$$$$$$$
-dread.faproot.com- *** Authentication phrase (method=sha1, para=$$$$$$$$$$$$$$$$) is: $jpfS8mFU$4WlHJnt9tSBdI8p8F44FTrBW6eM=
382: unrealircd.conf Rehashing
*** BekarfelACER sets usermode: -oghaANW
-> Server: oper Dreadnought $$$$$$$$$$$$$$$$
*** BekarfelACER sets usermode: +oghaANW
381: You are now an IRC Operator

-> Server: mkpasswd sha1 :0$1$2$3$4$5$6$7$8$9$0
-dread.faproot.com- *** Authentication phrase (method=sha1, para=0$1$2$3$4$5$6$7$8$9$0) is: $oottUh1d$m3mWlkmHFbCXgzdXGQfXnRooj3Y=
382: unrealircd.conf Rehashing
*** BekarfelACER sets usermode: -oghaANW
-> Server: oper Dreadnought 0$1$2$3$4$5$6$7$8$9$0
*** BekarfelACER sets usermode: +oghaANW
381: You are now an IRC Operator

Stealth

2013-07-27 18:40

reporter   ~0017729

Last edited: 2013-07-27 18:46

 Looks like some feedback is needed, because I can't break using:
Unreal3.2.10. server.example.com :FhinXeOoZEm3 [Linux server.example.com 2.6.32-358.6.1.el6.i686 #1 SMP Tue Apr 23 18:13:20 UTC 2013 i686=2311]
OpenSSL 1.0.0-fips 29 Mar 2010
zlib 1.2.3
libcurl/7.28.0 OpenSSL/1.0.0 zlib/1.2.3 c-ares/1.9.1 libidn/1.18

To really give this a test, I went ahead and made a password that contained nothing but special characters:
*** Authentication phrase (method=sha1, para=`$!\*}]-+""{!^`?%,/$..;,:{;}@_=-!+) is: $REEygdr3$31xM0HL24WSDx3kZj96KeaW320M=

I added this hash to my configuration:
oper test {
  from { userhost *@*; };
  password "$REEygdr3$31xM0HL24WSDx3kZj96KeaW320M=" { sha1; };
  class clients;
  flags { local; };
};

I rehashed:
*** Notice -- Stealth is rehashing server config file
-!- unrealircd.conf Rehashing
*** Notice -- Loading IRCd configuration ..
*** Notice -- Configuration loaded without any problems ..

I tried to oper:
-> server.example.com oper test `$!\*}]-+""%{!^`?%,/$..;,:{;}@_=-!+
<- :Main MODE Main :+ghsO
<- :server.example.com 008 Main :Server notice mask (+kcfvGqso)
<- :server.example.com 381 Main :You are now an IRC Operator

Success.

In all of the comments I don't see an example that breaks this. As ohnobinki pointed out, we'll need some form of "working" example!

(Edit: add more version info)

n0kS

2013-07-27 18:45

reporter   ~0017730

I noticed that my prior testing was incorrect so ignore my first comment here.

In the end this seems a picnic issue, not an unreal one...

ohnobinki

2013-07-27 19:20

reporter   ~0017731

I suspect that http://www.gnu.org/software/bash/manual/html_node/Shell-Parameter-Expansion.html#Shell-Parameter-Expansion was causing techman confusion.

Techman

2013-07-28 02:41

reporter   ~0017732

I tried making a password with the special characters again and it has the same problem. It's not longer an issue though because I switched to a password with just letters and numbers and it worked just fine.

Stealth

2013-07-28 05:18

reporter   ~0017733

I'm just closing this.

No one can seem to reproduce it and Techman won't give us the details on how he's getting it (like, actual examples) so there's no point in further investigation.

Anyone is welcome to reopen this if they manage to reproduce it and can provide exact details (password, hashed result, and oper block).

Techman

2013-08-01 20:35

reporter   ~0017735

Tried making this pass from the terminal and it didn't work:
michael@serv1:~/.UnrealIRCd/Unreal3.2.10.1$ ./unreal mkpasswd sha1 $hit$how
Authentication failed
---
Tried the same pass in my IRC Client, and got this:
2:31 PM *** Authentication phrase (method=sha1, para=$hit$how) is: $DjcXemrh$ZD3ONdZQG3zJOPNV7K0ibFVbHTw=

Hmm. Tried it and it worked in the client when I /opered up.

Btw, here's the oper block:
oper Test {
    class clients;
    from {
        userhost *@*;
    };
    password "$DjcXemrh$ZD3ONdZQG3zJOPNV7K0ibFVbHTw=" { sha1; };
    flags {
        services-admin;
        get_host;
                };
    swhois "Test";
};

Obviously, I removed the oper block from my IRCd :)

Techman

2013-08-01 20:48

reporter   ~0017736

Oh I see..terminal issue. Okay..I think this bug is pretty much a derp and done :P

Issue History

Date Modified Username Field Change
2013-07-26 23:53 Techman New Issue
2013-07-26 23:58 n0kS Note Added: 0017725
2013-07-27 05:10 ohnobinki Note Added: 0017726
2013-07-27 11:11 bekarfel Note Added: 0017727
2013-07-27 18:40 Stealth Note Added: 0017729
2013-07-27 18:40 Stealth Status new => feedback
2013-07-27 18:45 n0kS Note Added: 0017730
2013-07-27 18:46 Stealth Note Edited: 0017729
2013-07-27 19:20 ohnobinki Note Added: 0017731
2013-07-28 02:41 Techman Note Added: 0017732
2013-07-28 05:18 Stealth Note Added: 0017733
2013-07-28 05:18 Stealth Status feedback => closed
2013-07-28 05:18 Stealth Resolution open => unable to duplicate
2013-08-01 20:35 Techman Note Added: 0017735
2013-08-01 20:35 Techman Status closed => feedback
2013-08-01 20:35 Techman Resolution unable to duplicate => reopened
2013-08-01 20:48 Techman Note Added: 0017736
2013-08-02 01:30 Stealth Status feedback => closed
2013-08-02 01:30 Stealth Resolution reopened => unable to duplicate