Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A webshell and a normal file that have the same MD5

github.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: A webshell and a normal file that have the same MD5

#11

Post by 0points »

h4ck_th3_pl4n3t wrote: post #9
dsab wrote: post #4

It's a pity that there is no description of what it is supposed to be used for.

The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

> The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

That's only true if you ignore all the details.

As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone. Life would have taught you by now that the devil is in the details.

WP uses salt and multiple rounds of hashing, fully mitigating the md5 collisions being topic of discussion here.

So no, wp doesn't "use md5" in the sense that they would be vulnerable to this type of attack.

Source: https://developer.wordpress.org/reference/functions/wp_hash_...

Re: A webshell and a normal file that have the same MD5

#12

Post by downtown_ »

0points wrote: post #11
h4ck_th3_pl4n3t wrote: post #9

Earlier quoted context omitted.

The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

> The answer is likely wordpress, because its default wp_hash algorithm is still MD5. That's only true if you ignore all the details. As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone. Life would have taught you by now that the devil is in the details. WP uses salt and multiple rounds of hashing, fully mitigating the md5 collisions being topic of discussion here.…

This is not related to password hashing.,.

Re: A webshell and a normal file that have the same MD5

#13

Post by high_na_euv »

0points wrote: post #11
h4ck_th3_pl4n3t wrote: post #9

Earlier quoted context omitted.

The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

> The answer is likely wordpress, because its default wp_hash algorithm is still MD5. That's only true if you ignore all the details. As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone. Life would have taught you by now that the devil is in the details. WP uses salt and multiple rounds of hashing, fully mitigating the md5 collisions being topic of discussion here.…

Literally in this "article"

>Can use it bypass some cached webshell detections.

Re: A webshell and a normal file that have the same MD5

#14

Post by eptcyka »

0points wrote: post #11
h4ck_th3_pl4n3t wrote: post #9

Earlier quoted context omitted.

The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

> The answer is likely wordpress, because its default wp_hash algorithm is still MD5. That's only true if you ignore all the details. As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone. Life would have taught you by now that the devil is in the details. WP uses salt and multiple rounds of hashing, fully mitigating the md5 collisions being topic of discussion here.…

> As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone.

The amount of sweet, sweet irony displayed here will make me diabetic. Did you read the article at all? Salting? What are you on about?

Honestly, it feels that some HN commenters are LLMs instructed to defend a given entity.

Re: A webshell and a normal file that have the same MD5

#15

Post by szszrk »

chipsrafferty wrote: post #7
Incipient wrote: post #6

The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?

Yes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.

Is there any fairly popular software that still uses md5 in this context?

Most I've seen (sec scans, backup validation/dedup etc) pushed to phase out md5 very long time ago.

Re: A webshell and a normal file that have the same MD5

#17

Post by IshKebab »

chipsrafferty wrote: post #7
Incipient wrote: post #6

The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?

Yes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.

There's no need to rescan. You just need to use a secure hash.

Re: A webshell and a normal file that have the same MD5

#18

Post by magicalhippo »

Not only is MD5 broken as shown here, if you have a modern CPU it's also quite slow compared to good, non-broken alternatives. See for example this comparison[1] (post says JavaScript but it's actually OpenSSL's implementation that's actually tested).

[1]: https://lemire.me/blog/2025/01/11/javascript-hashing-speed-c...

Re: A webshell and a normal file that have the same MD5

#19

Post by falcor84 »

chipsrafferty wrote: post #7
Incipient wrote: post #6

The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?

Yes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.

>The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it

Wouldn't the sensible thing for a server that gets an upload matching an existing file's hash be to just treat it as an idempotent no-op? What reason would it have to replace the old version with a presumably identical copy? What am I missing?

Re: A webshell and a normal file that have the same MD5

#20

Post by slow_typist »

o11c wrote: post #3
andreareina wrote: post #2

The normal file doesn't look that normal

Keep in mind that the stated use is cache-poisoning of automated scanners, not fooling humans.

Humans have to put the so called php-file on the server intentionally for any subsequent attack to work. But it is a binary file.
Post reply on HN