Created
May 13, 2019 06:47
-
-
Save dasbairagya/0da5ad28da0c3987c59592b8da039f7d to your computer and use it in GitHub Desktop.
Drupal admin(uid = 1) password reset hack
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
use Drupal\Core\DrupalKernel; | |
use Symfony\Component\HttpFoundation\Request; | |
if (pathinfo(__FILE__, PATHINFO_FILENAME) == 'admin-pass-reset') { | |
die('Please change your file name to a random string to continue'); | |
} | |
// Boot Drupal. | |
$autoloader = require __DIR__ . '/autoload.php'; | |
$request = Request::createFromGlobals(); | |
$kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod', FALSE); | |
$kernel->boot(); | |
// Get password hasher service. | |
$password_hasher = $kernel->getContainer()->get('password'); | |
// Hash password. | |
if (isset($_GET['pass']) && !empty($_GET['pass'])) { | |
$newhash = $password_hasher->hash($_GET['pass']); | |
} | |
else { | |
die('Retry with ?pass=PASSWORD set in the URL'); | |
} | |
// Update user password. | |
$updatepass = Drupal::database()->update('users_field_data') | |
->fields(array( | |
'pass' => $newhash, | |
// 'name' => 'admin', | |
// 'mail' => '[email protected]' | |
)) | |
->condition('uid', '1', '=') | |
->execute(); | |
// Clean user 1 cache. | |
Drupal::cache('entity')->delete('values:user:1'); | |
print "Done. Please delete this file as soon as possible"; | |
?> |
👉️Drush command to change the username and pasword:
drush user-password USERNAME --password="SOMEPASSWORD"
👉️Path to drush: web$ ../vendor/bin/drush user-password USERNAME --password="SOMEPASSWORD"
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1)save this file(admin-reset.php) to the drupal root directory alongside /web where the autoload.php exists.
2)fire the url of your drupal site followed by /admin-reset.php?pass=your_pass.