The Problem

Recently i had to login into an abandoned instance of GLPI. GLPI is an Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company (computer, software, printers...). It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-system with mail-notification and methods to build a database with basic information about your network-topology. Unfortunately the administrator who set up the instance had quit his job without writing down the passwords to log into the system. So i had to find a way how to reset the password.

The Solution

Passwords for webapplications are usually stored in a database. The webapplication logs into the database and verifies the password that is entered in the frontend. So the first step was to find the correct database login. The file 'config_db.php' revealed the database login credentials for the application:

With this credentials you can log into the database (using the MySQL Commandline Client):

The trick is to log into the database (using the account from the config file), to find the users table and to overwrite the old password hash (in my case a MD5 hash) with a new one. This should work for a lot of web-applications that use authentication via a user table.

Another approach to avoid this type of situation is to use a password manager to store your user credentials. Creating a strong password is important in ensuring the security of your personal and business accounts. However, memorizing numerous passwords can be difficult and challenging which leads to using weak passwords, reusing the same passwords, and writing them down. With a password manager, you don’t have to remember these passwords. A list of the best password managers provided by the guys at digital.com which spent hours testing and utilizing more than 140 password managers available on the market.