how to reset super administrator password in Joomla 1.5 + ?

[dtuur]

I have lost the password for one of my sites and cannot seem to be able to reset it...

I read on the Dutch Joomla Blog that in Joomla 1.5 the password encryption has become more sophisticated. Is this the reason old reset-solutions do not work anymore?

I have tried several solutions:
http://community.contractwebdevelopment ... n-password
http://www.teachmejoomla.net/joomla/mam ... sword.html
http://help.joomla.org/component/option ... temid,268/

...but none of them seem to work. The login form won't accept me, saying: "Username and password do not match"

I have the 1.5.1 Stable Release installed.

Thank you for your support!


(blog post about the new encryption in joomla 1.5: http://www.joomla-blog.nl/blog/joomla/3 ... chtwoorden)

[humvee]

Directions

1. Use a MySQL utility such as phpMyAdmin

2. Open the database and select the table, jos_users . (replace jos_ with hyour own table prefix as appropriate).

3. Select the record for the administrator account - by default this is user 62.

4. Copy and paste the MD5 # below.

1232f297a57a5a743894a0e4a801fc3

5. Click Go to save the changes.

6. Point your browser to http://yoursitedomain.com/administrator . Enter the username admin and the password admin in the login box.

7. Once logged in go to User Manager and select the user you have just logged in with using this password and username and change the password for the user to something else. This is extremely important. Joomla! will encode this new password with the MD5 # and SALT encryption automatically.

8. Check all is ok with Front-end access by opening your site http://yourdomainname.com and logging in using the username asdmin and password as you have just set it in the Back-end.

All should be ok. Let us know

Andy

[asadallahi]

hi
i am using joomla 1.5.3 stable
and forget the admin password

i try "admin" md5 : 1232f297a57a5a743894a0e4a801fc3

but dosn't work ?
how can i change my password in joomla 1.5.3 stable?
the format of password field of jos_users table is like:

41d31ff79c7b4c06fe637a048ff6a8b9:h4w7MYUrIauuVV7aA71EsaWEoEZEnO3H

and its so longer than md5 hash!!!

please help me

[humvee]

The password encoding that is done by Joomla! itself not only uses MD5# but also SALT which takes the MD5# and encrypts it even further.

MD5# will still work as previously described

Andy

[wizeguy]

3. Select the record for the administrator account - by default this is user 62.

4. Copy and paste the MD5 # below.

1232f297a57a5a743894a0e4a801fc3

5. Click Go to save the changes.

I just typed in "admin" and dropped down to select "Md5" from the left drop down box and worked for me. Of course, I will change it now, you peepin toms.

[cdbrehm]

I am one of the victims of the Joomla 1.5 security abyss.

This solution does not work for me. I've tried it 15 times, following the instructions to the letter, and I cannot log in. Any other suggestions? This is VERY frustrating.

Apparently the only person who knows the super admin password now is the hacker.

[seola]

mee too, this stuff aint workin

the hacker changed the superadmin and i reset the password and it still does not work

[cdbrehm]

I found the solution that worked for me, but because it contained a link I think the moderators removed my follow-up post. So let me quote the solution that worked for me.


*****
A different approach ...
Submitted by Visitor From Afar on Fri, 2007-08-31 08:09.
By temporarily removing the authentication in PHP, you can let anyone login. So, in Joomla 1.5 RC, you can go to plugins/authentication/joomla.php and modify the line:

if ( $crypt == $testcrypt) {

so that it reads:

if ( true /* $crypt == $testcrypt */ ) {


Now everyone can login with any password. Change your password to something that you can remember. Do not forget to put the original authentication code back in.

Jack

********

Please note the last line, "Do not forget to put the original authentication code back in (if ( $crypt == $testcrypt) {)." Important!

[seola]

I did the backup, but for the next time thanks

But how did that Iranian fudge packer changed the admin, did he have the password to joomla, cold he login and change everything?

So my question is why he didnt totally destroy the site

[cdbrehm]

From what I'm hearing there's a major security vulnerability with Joomla versions 1.5.0 - 1.5.5. I upgraded to 1.5.6. You should probably do the same if you haven't already.
I think it has to do with the reset.php file. Not exactly sure. But I'ved heard the 1.5.6 upgrade patches the issue.

My understanding (someone can correct me here) is that they are somehow able to reset the super admin password.

I visited my site one day to see on my index page, "hacked by so-and-so" and nothing else. LOL. Originally I thought someone had hacked my FTP password, but this wasn't the case.

[seola]

Yes I upgraded of course

But if he has admin password and he could log in he could destroy the site, probably he is too stupid luckily
He chnaged superuser, add his email, his name, so all the emails would go to his email adress, that could do a lot of damage

And stupid f put a large image on homepage that a site is hacked, that is like going on the tv before robbing a bank

what an idiot

[cdbrehm]

Well, he was obviously very proud of himself and couldn't resist leaving his calling card. Some script kiddy with no girlfriend and far too much time on his hands.

[graphic3]

i tried the listed solution w/ the DB - didn't work for me... any other ideas?

nevermind - the php code snippet replace , worked like a charm - how to prevent this friend of ours from coming back?

[Vlistomatic]

I had also some problems with the super admin password (Joomla 1.5.3) but altering the joomla.php file worked fine. Afterward I changed the password in the back-end of my website to get the additional Salt encryption. However, when I check the MD5 hash in the SQL DB (jos_users, ID 62) the old "admin" hash (21232f297a57a5a743894a0e4a801fc3) is still there (without salt). So, it looks like the new password is stored somewhere else and not in ID62. Does anybody has a clue what's going on here?

[parapet]

FIXED: see note at the end of this post.
======================
I've got a similar problem.. I can't get into the backend of a site that I was able to get into a couple of days ago.

The site is using Joomla 1.5.6, and neither the PHP snippet nor the database fix work for me. I added a second super administrator a week ago, it worked at the time but now it no longer works either.

additional note: Further reading in the forum brought up the fact that when trying to login, I should see a message that the username and password don't match. I get no such message, just the login page again. I had also recently upgraded Phoca Gallery, could this have caused this issue?
======================
FIXED: turns out that a recent change I had made in the htaccess file, one that changes the URL to a "www" UL, was causing the issue. First time I've seen that happen, so I'm leaving this post in place in case it helps someone else.

[snowboarder]

Directions

1. Use a MySQL utility such as phpMyAdmin

2. Open the database and select the table, jos_users . (replace jos_ with hyour own table prefix as appropriate).

3. Select the record for the administrator account - by default this is user 62.

4. Copy and paste the MD5 # below.

1232f297a57a5a743894a0e4a801fc3

5. Click Go to save the changes.

6. Point your browser to http://yoursitedomain.com/administrator . Enter the username admin and the password admin in the login box.

7. Once logged in go to User Manager and select the user you have just logged in with using this password and username and change the password for the user to something else. This is extremely important. Joomla! will encode this new password with the MD5 # and SALT encryption automatically.

8. Check all is ok with Front-end access by opening your site http://yourdomainname.com and logging in using the username asdmin and password as you have just set it in the Back-end.

All should be ok. Let us know

Andy

Mate, that MD5 wont work. Not enough characters. You need a 2 at the beggining!

[somethingelse]

FIXED: turns out that a recent change I had made in the htaccess file, one that changes the URL to a "www" UL, was causing the issue. First time I've seen that happen, so I'm leaving this post in place in case it helps someone else.

care to share exactly what you did? I cannot get logged in no matter what I try, and it's really causing me a lot of anxiety... have tried ALL the above solutions with no success, and do NOT get a "username or password are incorrect" message... just a regular old admin login screen... try to go to a memorized url and get back to the login too (which i'd expect if my login were incorrect, but it's NOT)

it just doesn't make any sense

[snowboarder]

FIXED: turns out that a recent change I had made in the htaccess file, one that changes the URL to a "www" UL, was causing the issue. First time I've seen that happen, so I'm leaving this post in place in case it helps someone else.

care to share exactly what you did? I cannot get logged in no matter what I try, and it's really causing me a lot of anxiety... have tried ALL the above solutions with no success, and do NOT get a "username or password are incorrect" message... just a regular old admin login screen... try to go to a memorized url and get back to the login too (which i'd expect if my login were incorrect, but it's NOT)

it just doesn't make any sense

Do what Humvee said but put a 2 in front on the MD5 code he says. He put the code in wrong, it should have 32 characters - all MD5 # numbers have 32 characters.

[rliskey]

This technique is explained here:
Security and Performance FAQs: How do I reset an administrator password?

[stuupke]

Directions

1. Use a MySQL utility such as phpMyAdmin

2. Open the database and select the table, jos_users . (replace jos_ with hyour own table prefix as appropriate).

3. Select the record for the administrator account - by default this is user 62.

4. Copy and paste the MD5 # below.

1232f297a57a5a743894a0e4a801fc3

5. Click Go to save the changes.

6. Point your browser to http://yoursitedomain.com/administrator . Enter the username admin and the password admin in the login box.

7. Once logged in go to User Manager and select the user you have just logged in with using this password and username and change the password for the user to something else. This is extremely important. Joomla! will encode this new password with the MD5 # and SALT encryption automatically.

8. Check all is ok with Front-end access by opening your site http://yourdomainname.com and logging in using the username asdmin and password as you have just set it in the Back-end.

All should be ok. Let us know

Andy

I exactly tried to do as descripted, but no result

[stuupke]

I found the solution that worked for me, but because it contained a link I think the moderators removed my follow-up post. So let me quote the solution that worked for me.


*****
A different approach ...
Submitted by Visitor From Afar on Fri, 2007-08-31 08:09.
By temporarily removing the authentication in PHP, you can let anyone login. So, in Joomla 1.5 RC, you can go to plugins/authentication/joomla.php and modify the line:

if ( $crypt == $testcrypt) {

so that it reads:

if ( true /* $crypt == $testcrypt */ ) {


Now everyone can login with any password. Change your password to something that you can remember. Do not forget to put the original authentication code back in.

Jack

********

Please note the last line, "Do not forget to put the original authentication code back in (if ( $crypt == $testcrypt) {)." Important!

sorry, it didn't work

[Imago]

If it doesn't work, open your mysql dump, copy the admin password and edit your actual admin entry.

[stuupke]

If it doesn't work, open your mysql dump, copy the admin password and edit your actual admin entry.

tried that too, no result. I'm now going to try to put back a full sql dump. If that doesn't work. I'll will put back a full back-up of the site

[Imago]

Can you register as a regular user? Register and make yourself superadmin in DB.

[stuupke]

Can you register as a regular user? Register and make yourself superadmin in DB.

Thnx for the tip. But I was lucky to find a back-up (SQL) from not so long ago. So I put that one back and the problem was solved.

[rliskey]

I exactly tried to do as descripted, but no result

In general, you can get more help from others when you give more complete information about your problem.

[poljakov]

I think there can be other problems as well.

I got the same problem as above. Neither the password recovery, nor a regular user's registration works.

After the installation I saw session warnings/errors, do notremember. I tried to fix the empty line problems you recommended here. I found this only in the configuration.php file, the first line must be removed. (It is really a big problem, cause I'd like to use international chatacters in this file, and after removing the Byte Order Mark, the file is loading wrongly into my editor.) After that, the session warning dismissed but the login and the registration work not.

My Joomla is hosted at a free hosting company, maybe the main PHP settings are wrong. Ho do you see? How can I check the necessary PHP settings and what they are?

[CliffH]

Hey guys here is the solution. don't put the put the encrypted password in the md5 field. Just put the word admin in the md5 field, and save. Now you can log in with admin as the password.

[poljakov]

I think, the password recovery worked, but there are other problems. I tried to log in with admin/admin or admin/other_pass, I got back the login screen without any error message. If I try to log in with bird/cage, then I got this message: Username and password do not match .

[JontyPTraveler]

No one seems to have posted the md5 and the salt for at least one password like "admin"? OK, the first one to do it gets the traffic... Post it if you know it. I don't think anyone has done it yet. Seems easy, but I don't know if I'll figure it out tonight.

Basically, Joomal 1.0 used a md5 hash, made a 32 character hash.
You can use "21232f297a57a5a743894a0e4a801fc3"
in the database to create "admin" as a password.

Joomla 1.5 used an md5 hash and a salt hash...
it looks like about twice the number of characters.

Anyone know the Joomla 1.5 hash for admin? I'll race you to it...