Joomla Password Authentication in Visual Basic .NET

Question

I have managed to successfully connect remotely to the MySQL database for my Joomla! 1.5 website using MySqlConnector in Visual Basic .NET 2010.

Now I am trying to authenticate a user's password from values submitted in a simple form to those retrieved from a MySQL query.

I found a useful thread on forums.joomla.org titled "Joomla password MD5 & VB.NET MD5", but the code snippets there produce the incorrect hash.

Here is another useful Joomla Forums thread as to how passwords are encrypted (using MD5 hash and "salt") in the Joomla DB.

Here is a modified version of the code:

Imports System.Text
Imports System.Security.Cryptography

...

Private Function JoomlaUserAuth(ByVal Password As String, ByVal EncryptedPassword As String) As Boolean

    'HashedPassword:Salt = value from Joomla DB

    Dim Values() As String = Split(EncryptedPassword, ":")
    Dim HashedPassword As String = Values(0)
    Dim Salt As String = Values(1)


    Dim NewHashedPassword As String = GetHash(Password & Salt)

    Return NewHashedPassword.Equals(HashedPassword)

End Function


Private Function GetHash(ByVal StringToHash As String) As String
    Dim md5 As New MD5CryptoServiceProvider()
    Dim encoder As New UTF7Encoding()
    Dim encStringBytes As [Byte]()

    encStringBytes = encoder.GetBytes(StringToHash)
    encStringBytes = md5.ComputeHash(encStringBytes)

    Dim strHex As String = String.Empty
    For Each B As Byte In encStringBytes
        strHex &= String.Format("{0:x2}", B)
    Next

    Return strHex

End Function

The result is that "NewHashedPassword" and "HashedPassword" are very different using the correct password/DB encrypted password combination. Any ideas?

Hmm. I was testing this code using an administrator's credentials, but after trying a standard user, it worked! Is there a different encryption method for Admins in Joomla? — Lincoln Quick
Joomla passwords are salted by default, if you manually create a user without the salt it should still work. Did you manually create the other user? — udjamaflip

Yiannis Mpourkelis Yiannis Mpourkelis · Accepted Answer · 2011-10-24T13:14:18

To get the correct hash for the user password you should input the password twice, something like:

Dim NewHashedPassword As String = GetHash(Password & Password & Salt)

Joomla Password Authentication in Visual Basic .NET

1 Answers