Need to manually hash password

essrhill

I got a login failure trying to login the first time after setting up a new instance of OSTicket. So, my only user account, the admin one created during installation, can't be logged into. I want to generate a hash of a new password and enter it into the DB. I'm trying to use the code in PasswordHash.php but I can't find what OSTicket passes into the contructor, ie what vaule for these two arguments ($iteration_count_log2, $portable_hashes).

OSTicket V 1.16.1

KevinTheJedi

essrhill

Just use a bcrypt generator to hash the password string and update the password in the database to that hash.

Cheers.

essrhill

Thanks for the reply. So, I tried that. The generator I used had a default of 12 iterations. That did not work. The iteration count looks to be the first argument passed in.

Or, if anyone can give me a plain text password with a matching hash that would be great, even if it's 'password' or '1234' I just need to be able to login one time.

ntozier

Try this
https://tmib.net/recover-or-reset-admin-account-passowrd-in-osticket/

essrhill

While I appreciate both of you for posting neither of those worked. It's definitely not an MD5 hash. Bcrypt makes more sense and the hash length is correct but without knowing how many iterations or if there is a salt involved I could not come up with a correct hash. I ultimately solved this by creating the same user on a different instance, then copying the hash from that DB. Perhaps when I have time I'll go through all the code and figure out exactly what it's doing.

ntozier

essrhill It's definitely not an MD5 hash.

Correct it is not, but the system can read the MD5, and can let you break into your account that way.

KevinTheJedi

@essrhill

You can use this site, choose 8 round entropy, and that will work in the database. If not then you have something whacky going on.

Cheers.