hashcat Forum
How to crack apple sparsebundle password - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: How to crack apple sparsebundle password (/thread-11586.html)



How to crack apple sparsebundle password - manubb - 09-01-2023

Hi. 
I need to recover some passwords used to encrypt apple time machine archive. I found the related hash by using the dmg2john tool. 
The content of the hash looks like:
Code:
/Users/foo/Desktop/Test.dmg:$dmg$2*20*22e9247d0cd8f06b3ea29893fbdb574981efbd3a*32*7ba0f061afe9bd25000000000000000000000000000000000000000000000000*48*ca0603773f7c2c8b4bccd01590f001e0abffe12da002829698b93fb4c57f5aa43b6278c5cf1c1ed18da1064f7fc4900a*24418*4608*0362d58dbdddaf46774203022cbf95697ec96e9cf465fe657551948a212e0aed2ed8829c360360d9f2ec2fb8abe64
... many chars ...
593db9d5c79f340c689c515d4bf9260b04ead1a273ee8cd8763c8f4f8eb49eaa6894ae0207bf678a8a2220727b2f079223462f9071451b1bd45967c392ced9b6941e8b*1*db224728e6cf8e00765594f4b9138e930caa24a66bacc473aa93e202d71daaecece0f2ff868f8c0b5d8a78ce733bcfa7c6adb20557c5be9e92fef9ee77b9bd71ba
... many chars ...
7237792ec388dcdf91babca760ccd057fe4598176a867605ed972a413956f50a74b17134f166a3d3af73b696cac6213f1b09dbd*434782::::Test.dmg

Can someone help to format the hash and configure hashcat to search for the password?
Thanks!


RE: How to crack apple sparsebundle password - marc1n - 09-01-2023

https://hashcat.net/wiki/


RE: How to crack apple sparsebundle password - manubb - 09-01-2023

Thanks but i need more help to get me on track. I've looked at the hash formats supported by hashcat but did not find one close to the hash format above. Is it simply possible to do what i want?


RE: How to crack apple sparsebundle password - marc1n - 09-01-2023

(09-01-2023, 03:47 PM)manubb Wrote: Thanks but i need more help to get me on track. I've looked at the hash formats supported by hashcat but did not find one close to the hash format above. Is it simply possible to do what i want?

This hash is not support by hashcat you must use john the ripper to crack it.


RE: How to crack apple sparsebundle password - manubb - 09-02-2023

Thanks @marc1n