Samba Password Hash Algorithm

V5 Question
1

Hi, I’m looking to authenticate against Samba’s Users table using the built-in password. I’m wondering what hashing algorithm was used. It looks like all passwords are prepended with “SPHASH”. Is that part of the hash or some sort of other data?

Thanks.

2

The password for Users in the database is not encrypted.

3

What are you needing this for? Maybe we can help…

4

Sorry let me rephrase. The pincode is not. Password is different. Sorry.

You need password? That is for GQL functions I’m pretty sure. It’s tied to applications.

5

Are you sure you’re not thinking of PIN? PINs are indeed not encrypted (although they should be) but passwords are. Passwords are used for API access. I also want to use it for my web app so employees can experience SSO.

Screenshot (3)
Screenshot (3)1366×768 106 KB

1 Like
6

User passwords stored as one way hashes.

7

I figured that, but I was wondering what the hashing algorithm was. For example: bcrypt.

8

Oh hmm I don’t think Emre ever discussed that.

9

Is it perhaps ms sql’s built in PWDENCRYPT() function?

10
11

That is all I can find

12

I suppose there’s no access to the code for the Verify() method? Maybe it’s base64 like the comment says. That would be very insecure…

13

Looks like the prepended data “$SPHASH$V1$” is used to identify the password version, perhaps for future releases, backward compatibility, etc. The data is removed via the Replace() method and then the remaining data is split at the remaining $ which gives an array of [10000,hash…]. Now I’m wondering what the 10000 means haha.

1 Like
14

10000 is the amount of iterations the cipher is applied to the input string. 10000 is the min for PBKDF2.

If you’re working with PHP you can use a .Net library via dotnet.

15

Hi Thanks Memo. I see there’s a hash_pbkdf2 function for php. I’m having trouble translating the C# to php though. Specifically how the SaltSize variable is derived and the Array.Copy method (5 arguments?).

16

I’m running php on a LAMP stack so I can’t use the dotnet dll.

17

I tried looking at some sample code and I can’t make heads or tails of how to check the C# hashed password.

When it comes to the cryptological stuff I don’t really understand what it’s all doing with all the byte array stuff. Maybe one day.

I had an inkling the dotnet in php was windows only but I’ve never used it, just remember reading about it.

May I recommend StackOverflow… :laughing: =]

18

Yeah I think I can get it figured out. I need to know the SaltSize variable. It seems to be outside of the code snippet from Samba’s Verify() method.

19

salt size is 16
…

20

Ok, I’m getting closer. Do you know HashSize and the hash algorithm?

Here’s my function so far:

<?php
// SambaPOS's prepended data to password hash
define("PW_VER_STRING", '$SPHASH$V1$');
define("SALT_SIZE", 16);

$hash_pw = '$SPHASH$V1$10000$s9jDG3+SOfSnTcb/BQScxGnUR58kr3UxZg9GirPrkBQ6yVAD';
echo pw_verify("SomePassword", $hash_pw);

function pw_verify($pw, $hash)
{
    // Get rid of version data
    $hash = str_replace(PW_VER_STRING, "", $hash);

    // Split hash into iterations, hash
    list($iter, $hash64) = explode("$", $hash);

    // Base64 decode hash
    $hashBytes = base64_decode($hash64);
    $salt = array_slice(array_values(unpack('C*', $hashBytes)), 0, SALT_SIZE);
    print_r($salt);
}
?>

Here is PHP’s equiv. of the C# class:

hash_pbkdf2 ( string $algo , string $password , string $salt , int $iterations [, int $length = 0 [, bool $binary = FALSE ]] ) : string