GUIDE CoreProtect password extractor & authentication bulk registration (Python)

Joined
Feb 23, 2026
Messages
39
Reaction Score
27
Shards
◆192

Extract CoreProtect Passwords & Auto-Register in Minecraft quick setup using Python​

This toolset extracts passwords stored in CoreProtect's command logs and automatically registers them in AuthMe, effectively migrating player credentials from one plugin (e.g. Authy) to another (e.g. AuthMe).

> CoreProtect: https://github.com/PlayPro/CoreProtect
Limitation / Requirement:
- This method typically recovers credentials for ~80% of active players.
- CoreProtect must be running for at least ~1 week to capture sufficient /login command logs.

File 1:​

Extracts all /login commands from CoreProtect's co_command table and saves them to /root/pass.yml. It connects via MySQL socket/SQLite DB, maps user IDs to usernames from co_user, and creates a clean YAML file with player names and passwords.

File 2:​

Reads /root/pass.yml, parses player names and passwords, then sends /authme register <name> <password> commands directly into your Minecraft server's tmux session. Perfect for bulk registration after a server wipe or new authentication plugin setup.

Workflow:
CoreProtect DB -> pass_export.py -> pass.yml -> ingame_reg.py -> tmux -> Your Minecraft Server
- CoreProtect stores login commands with passwords
- Authentication plugin uses /register syntax
- Server runs in a tmux session for command injection
- MySQL socket authentication is available (password-less root access) or SQLite file

 

Attachments

I encountered a significant migration issue when transitioning between two authentication plugins with fundamentally different encryption architectures. The source plugin used a proprietary, heavily obfuscated encryption algorithm that made direct data migration impossible, while the target plugin (AuthMeReloaded) offered better compatibility but employed a completely different hashing mechanism. This experience taught me that, when facing incompatible encryption systems, sometimes the solution isn't to break the encryption, it exists in my ecosystem: Logging systems, backup scripts, and admin interfaces often contain the data I need in plaintext form:rolleyes:
 
Back
Top