+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Extract hash from veracrypt encryption (/thread-11893.html)
Extract hash from veracrypt encryption - zerozero - 04-05-2024
Client asked me if i can crack his drive(he remembers most of the password, but forgot few characters), which is encrypted with veracrypt. It asks for a password and PIM(pim wasnt set, so its just the default value) upon booting.
Im having trouble understanding on how can i extract the hash from this type of encryption with dd.
Veracrypt + boot mode + hidden (im not sure which hash algo he used, i believe its the default one)
I tried this
dd if=\\?\Device\Harddisk1\Partition0 of=hash.tc bs=1 skip=65536 count=512
and it said "Error reading file: 87 The parameter is incorrect"
So my question is where am i failing at?
I tried following this, but im not sure if im approaching this correctly
https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes
RE: Extract hash from veracrypt encryption - b8vr - 04-05-2024
(04-05-2024, 02:18 PM)zerozero Wrote: Client asked me if i can crack his drive(he remembers most of the password, but forgot few characters), which is encrypted with veracrypt. It asks for a password and PIM(pim wasnt set, so its just the default value) upon booting.
Im having trouble understanding on how can i extract the hash from this type of encryption with dd.
Veracrypt + boot mode + hidden (im not sure which hash algo he used, i believe its the default one)
I tried this
dd if=\\?\Device\Harddisk1\Partition0 of=hash.tc bs=1 skip=65536 count=512
and it said "Error reading file: 87 The parameter is incorrect"
So my question is where am i failing at?
I tried following this, but im not sure if im approaching this correctly
https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes
So just to be clear, it's a system drive? It's bootable? In that case use veracrypt2hashcat.py
It's located in the tools folder of hashcat 6.2.6
It can be run like:
veracrypt2hashcat.py --offset=bootable path-to-drive
The algo is found in a file called dcsprop located in the EFI folder of the boot partition.
Then use mode 294xx to attack with.
If you want to stick with dd, I think your path is incorrect. Is it on windows? Then it's \\.\physicaldriveX
RE: Extract hash from veracrypt encryption - zerozero - 04-06-2024
Yes, it's system drive + bootable
So im guessing i have to use this offset - bootable
So the command looks like this now "veracrypt2hashcat.py --offset=bootable \\.\physicaldrive1"
It returned a hash.
However the algo, im not sure how to access the dcsprop, because i can't open EFI folder. Do i have to mount it ?
RE: Extract hash from veracrypt encryption - b8vr - 04-06-2024
You can open it in a forensic tool, like FTK or similar.