Luigi Auriemma

Ok So I just used ventrilopwd and got back encoded passwords. Is there any way to decrypt them? Are they md5-hashes?

Heres what it outputs

Hostname (Im hiding this)
Port (hiding this also)
EncPass D8F7D79766B8AEFBA6507E02E158899E8B93DABBFDBD223D3798C1857868D063

that tool is old, I will recheck and update it soon

Ok thank you very much. Your tools are great.

its a SHA-2 (256) hash.
cain supports that and can crack such password hashes.
http://www.oxid.it/cain.html

I have rechecked the tool and any EncPass* password is just the hashed password calculated with the Ventrilo password algorithm:

http://aluigi.org/papers/ventrilo_pwd_hash.h

So you can't decrypt or recover them

It's hard to tell what algorithm a hash was generated from because all you have to see is the hexidecimal output and length...which is why reverse engineering is usually needed in figuring that stuff out. For example seeing a hash like the posts above could be a lot of things:

SHA256
Haval256
RipeMD256
SNEFRU256

or even

MD5MD5
MD5SHA1
...etc

...or it could be customized for the program like it appears to be for ventrilo.

So what is the point of having ventrilopwd and ventrilo_pwd_hash.h if Enc passwords can't be decrypted? Someone enlighten me... = /

it's decrypted and it decrypts it, this is the sense.
the fact that then the hash is brute forcable or not it's an unrelated thing