Decoding and reading data of a session of dry land

Question

I just noticed that my host started using Suhosin Hardening, I am not completely familiar with this, and I have serious problems with my application, mainly in sessions.

The session will be saved in the following format:

_EzyqHpPJqmQbSpRmXAJTxuFq980aNQlc3XAiRkWxlZQ9B0fnV... 

I do not mind this, but also breaking my application, I need a way to decode the encryption, because because of this, it does not allow me to enter my application.

I have a function for unserializing session data, not sure where I got it, but here it is:

 public function unserialize_session_data($data) { $variables = array(); $a = preg_split( "/(\w+)\|/", $serialized_string, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE ); for( $i = 0; $i < count( $a ); $i = $i+2 ) { $variables[$a[$i]] = unserialize( $a[$i+1] ); } return($variables); } 

It gives bias errors with this function because the session data is not in the format that it expects, and that is why I was wondering if anyone knew of a way to decrypt / decode the aforementioned ugly data of Sukhoshin to present it in its original format ?

- EDIT -

Posting a function that uses the unserialize function above

  /*********************************************************************** # Get Session Data of a certain session id # -------------------------------------- # This function will retrieve all session information related to a certain session id from # the database, after that it unserializes the data and returns an array of data. # # @return array (Containing Session Data) ***********************************************************************/ public function get_session_data($session_id) { if (isset($session_id) && $session_id != "") { $sql = mysql_query("SELECT ses_value FROM sessions WHERE (ses_id = '$session_id');") or die ("MySQL Error : <b>" . mysql_error() . "</b><br />"); if (mysql_num_rows($sql) > 0) { $res = mysql_fetch_assoc($sql); $res = $this->unserialize_session_data($res['ses_value']); return $res; } } } 

Thanks in advance!

Answer 1

I thought the decryption and encryption of Sukhozin was transparent?

 Parameter Description Encrypt Turns on the transparent encryption 

In any case, the method of generating the encryption key:

 cryptkey + user agent + document root + IP octets 

So:

 12345Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2/var/www127.0.0.1 

Variables are combined without a separator. If for some reason the cryptkey string is NULL, then Suhosin will default to "D3F4UL7".
After the constructed string is hashed using SHA256 and the result used to generate the 256-bit rijndael encryption key.

Answer 2

If you need to recover data that was saved in a session, you can use the tool available here:

http://www.idontplaydarts.com/2011/11/decrypting-suhosin-sessions-and-cookies/

There is no native way to decrypt Suhosin data in PHP — the easiest way is to simply turn off encryption using session.encrypt = 0 in the php.ini file.

Answer 3

Can you just use ini_set() to disable its encryption?

• suhosin.session.encrypt

You will need to specify the exact key that you want to use to encrypt the session data (what the page indicates can be done via ini_set() ) to decrypt it. To do this, decrypt it should be possible using a key (I do not know which encryption system it uses).