Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jul 2012 22:16:40 +0530
From: Dhiru Kholia <>
Subject: Re: john with Apple Keychains (/Users/Alex/Library/Keychains/login.keychain)

On Thu, Jul 19, 2012 at 10:10 PM, Aleksey Cherepanov
<> wrote:
> Hi Alex,
> On Thu, Jul 19, 2012 at 06:24:23PM +0200, Alex Kornilov wrote:
>> I try to "crack" my OS X login password. Our company purchased an
>> old Openwall wordlists collection (very old!!)
>> $ john --wordlist=/Users/Alex/Downloads/wordlist_john/Wordlists-20031009/all.lst
>> login.keychain.bak
>> Loaded 1 password hash (Tripcode DES [48/64 4K])

Is this a bug? login.keychain.bak shouldn't have been detected as Tripcode DES.

>> guesses: 0  time: 0:00:00:05 100%  c/s: 434352  trying: ???????? - ???
>> finishes after a few seconds :-(
>> $ john -show login.keychain.bak
>> 0 password hashes cracked, 1 left
>> what I am doing wrong?

Which Operating System are you using? You might be able to use
pre-compiled JtR versions depending on your OS.

For cracking OS X Keychains (which you seem to be doing) you need
jumbo version of john. You can get it from After doing "git clone",
build john, run keychain2john program on login.keychain.bak file and
then run john on the output of keychain2john.

Another option is to obtain OS X hashes (using program,
included with john-jumbo) and crack those to figure out the login
password. This option will be way faster than trying to crack the

(Compile keychain2john using command "gcc keychain2john.c")

> I guess you need to specify hash type. Try to add --type=keychain to
> your cmdline.

First run keychain2john on your keychain file and then run john on the
output of keychain2john.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.