Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jul 2012 21:27:41 +0400
From: Solar Designer <>
Subject: Re: john with Apple Keychains (/Users/Alex/Library/Keychains/login.keychain)

On Thu, Jul 19, 2012 at 07:13:33PM +0200, Alex Kornilov wrote:
> this way don't work:
> $ ./ /Users/Alex/Library/Keychains/login.keychain.bak
> Could not find a Mac OS X 10.7 Lion salted SHA-512 hash in file: 
> /Users/Alex/Library/Keychains/login.keychain.bak

Perhaps you misunderstood.  Dhiru correctly suggested that if at all
possible you don't crack the keychain directly, but instead crack the
login password for the OS X user account, which is usually the same.

So you'd need to run on the plist file containing that
password hash.  Not on the keychain.

As to cracking the keychain:

> second try:
> $ gcc keychain2john.c
> $ ./a.out /Users/Alex/Library/Keychains/login.keychain.bak > /tmp/john
> $ john 
> --wordlist=/Users/Alex/Downloads/wordlist_john/Wordlists-20031009/all.lst 
> /tmp/john
> No password hashes loaded (see FAQ)
> also doesn't work.

This suggests that your build of John most likely lacks keychain
support.  What version of John is that?  Surely keychain2john.c is
recent (it did not exist before), but is the John build itself also as
recent?  It does not look like it is.

Thank you for helping us test the keychain support!  It is a very recent
feature, so there may be issues with it (beyond lack of documentation).


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.