Authentication

One of the main objectives of the md5 hash algorithm is the imposibility of recover the original string. So, teorethicaly is imposible to recover the original password using the md5 string stored on the Moodle database.

I found very useful to write a script in Perl to reset a user password from the command line of the server. Here it is

#!/usr/bin/perl -w
# set.moodle.pw.pl
# It's easier to change the password on the command line

use DBI;
use Digest::MD5 qw(md5 md5_hex);

my $dbhost = 'localhost';
my $dbname = 'moodle';
my $dbuser = 'user';
my $dbpass = 'pass';

my $nArgs = $#ARGV + 1;
die ("Usage: set.moodle.pw username password\n") if $nArgs != 2;

# Copy the $CFG->passwordsaltmain from the config.php file
my $passwordsaltmain = 'your_password_salt_main';

# Connecting, selecting database

my $dbh = DBI->connect("dbi:Pg:dbname=$dbname", "$dbuser", "$dbpass") or die('Cannot connect to database: ' . $DBI::errstr);

print "User: $ARGV[0] password: $ARGV[1]\n";
my $sSql = "UPDATE mdl_user SET password='" . md5_hex($ARGV[1],$passwordsaltmain) . "' WHERE username='" . $ARGV[0] . "';";
print "$sSql\n";
my $sth = $dbh->prepare($sSql) or die $dbh->errstr;
my $result = $sth->execute;
print "Updated $result account\n" if ($result > 0);
$dbh->disconnect;
1;

------------------------------------------------------

I hope it works for you too.

MS SQL Server 2008 solution: (I apologize for the formatting but I can't submit the post without injecting the slash into the declaration due to a firewall rule.  Just remove the slash from each declaration and it'll work.)

DECLAR/E @salt VARCHAR(32)
DECLAR/E @password VARCHAR(32)
DECLAR/E @varbinary_hash VARBINARY(MAX)
DECLAR/E @hash VARCHAR(32)

SET @salt = 'YOUR_SITE_SALT_HERE'
SET @password = 'USER_PASSWORD_HERE'
SET @varbinary_hash = HASHBYTES('MD5', @password + @salt)
SET @hash = LOWER(CONVERT(VARCHAR(MAX), @varbinary_hash, 2))