john-users - Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 25 Sep 2011 22:01:55 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)

On Fri, Sep 23, 2011 at 08:16:39AM -0700, Link, Peter R. wrote:
> It tool 17min 50 sec to crack the new password on a 2.4GHz MacBook Pro (circa 2007). I created the password file by hand.

Apparently, you didn't have "tomorrow" in your wordlist.  Indeed,
password.lst supplied with JtR doesn't have it (not in top 3000 or so).
Using all.lst (from the Openwall wordlists collection), JtR cracks this
password in under a second.

> robert1new.plist is the one that doesn't work.

Here's a corrected version.  This one works on both files for me.
(Replaced "." with "[\x00-\xff]" to match linefeed characters as well.)

---
#!/usr/bin/perl

read(STDIN, $_, 1000000) || die;

($hash) = /bplist00\xd1\x01\x02\x5dSALTED-SHA512\x4f\x10\x44([\x00-\xff]{68})/;
if (!$hash) {
	print "Could not find a Mac OS X 10.7 Lion salted SHA-512 hash\n";
	exit 1;
}

print unpack('H*', $hash), "\n";
---

Thanks,

Alexander