john-users - Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)

Openwall wordlists collection for password cracking (20+ languages)

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 25 Sep 2011 22:44:11 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)

Jim -

On Fri, Sep 23, 2011 at 12:51:04PM -0500, jfoug wrote:
> I also added code to find the user id.

Thanks!  Attached is a version of the script with our changes merged.
I hope you agree with my choice of the license.

I think we should place this under run/ in the next -jumbo.

Alexander

#!/usr/bin/perl -w
#
# Copyright (c) 2011 Solar Designer
# Copyright (c) 2011 Jim Fougeron
# Redistribution and use in source and binary forms, with or without
# modification, are permitted.  (This is a heavily cut-down "BSD license".)

use strict;

die "Usage: $0 PLIST-FILES > PASSWORD-FILE\n" if ($#ARGV lt 0);

my $file;
foreach $file (@...V) {
	my ($hash, $user);

	unless (open(F, "< $file")) {
		print STDERR "Could not open file: $file ($!)\n";
		next;
	}
	unless (read(F, $_, 1000000)) {
		print STDERR "Could not read file: $file\n";
		close(F);
		next;
	}
	close(F);

	($hash) = /bplist00\xd1\x01\x02\x5dSALTED-SHA512\x4f\x10\x44([\x00-\xff]{68})/;
	if (!$hash) {
		print STDERR "Could not find a Mac OS X 10.7 Lion salted SHA-512 hash in file: $file\n";
		next;
	}

	($user) = /\x3a\x53\x48\x41\x31\x2e[\x00-\xff]{40}([\x20-\x39\x3b-\x7e\xa0-\xff]{1,64})\xa1\x35\x4f\x10/;

	$user = "UNKNOWN_USERNAME" unless ($user);

	print $user, ":", unpack('H*', $hash), "\n";
}