I had a simaler problem one time where I had to find the admin and host passwords for my portal. The problem as you said is that they are encrypted, and stored in the table aspnet_membership. Sincie DNN uses 3DES I am sure that you do not want to figure it by hand even though you have the encryption and decryption key in the web.config file. So heres what I did
Create another User with a password that you know.
Go into the table that stores the encrypted passwords, and find the user that you just created.
Of course this users password is also encrypted (But you know what it is because you just created the password)
Copy that password and find the admin account. Then replace admin account password with the password to the user account you just created
save your database and log into DNN as admin the password will be the same password as the password to the user account that you just created
Isn't it fun to hack the database 
Hope this helps
Mike