hashcat Forum
OSX 10.10 (-m 7100) Hash Question - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: OSX 10.10 (-m 7100) Hash Question (/thread-4804.html)

OSX 10.10 (-m 7100) Hash Question - ZappedComet - 11-10-2015

Hey all, I'm working on a pentest engagement and got the hash for an OSX (v10.10.5) account using this technique.

According to the plist file, it's a SALTED-SHA512-PBKDF2 key, I have the entropy, iterations, and salt values properly created in a file on disk.

When I run oclHashcat (1.37) against it, I get a line-length exception.
When I run hashcat (0.50) against it, it recognizes the hash and works perfectly.

I get the exact same errors when I use the Mode 7100 example hash from here.
Can anyone tell me what might be causing the inconsistencies? I'd certainly prefer to use oclHashcat against it to better leverage my GPUs.

Thanks!

RE: OSX 10.10 (-m 7100) Hash Question - philsmd - 11-10-2015

you need to remove the whitespaces (most importantly the spaces " ") at the end of the lines.

RE: OSX 10.10 (-m 7100) Hash Question - ZappedComet - 11-10-2015

There are no whitespaces at the end of the lines. Thank you for the suggestion, though.

The line is $ml$iterations$salt$entropy with no whitespace anywhere.

RE: OSX 10.10 (-m 7100) Hash Question - mastercracker - 11-12-2015

Make sure you point oclhashcat to the right hash file. Otherwise can you post the 2 command lines you used for hashcat and oclhashcat?

RE: OSX 10.10 (-m 7100) Hash Question - ZappedComet - 11-12-2015

Here they are:

Code:
~/hashcat-0.50$ ./hashcat-cli64.bin -m 7100 ~/hashes/customers/X/hash.txt ~/dictionaries/g0tmi1k-18-in-1.txt

Which gives me:

Code:
This copy of hashcat will expire on 01.01.2016. Please upgrade to continue using hashcat.

Initializing hashcat v0.50 with 24 threads and 32mb segment-size...

Added hashes from file /home/opencl/hashes/customers/X/hash.txt: 1 (1 salts)
Activating quick-digest mode for single-hash with salt

[s]tatus [p]ause [r]esume [b]ypass [q]uit => s

Input.Mode: Dict (/home/opencl/dictionaries/g0tmi1k-18-in-1.txt)
Index.....: 1/1166 (segment), 2971922 (words), 33550336 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 200 plains, 200 words
Progress..: 1368/2971922 (0.05%)
Running...: 00:00:00:07
Estimated.: 00:04:07:32

And oclHashcat:

Code:
~/oclHashcat-1.37$ ./oclHashcat64.bin -m 7100 ~/hashes/customers/X/hash.txt ~/dictionaries/g0tmi1k-18-in-1.txt

And running the second gives me:

Code:
oclHashcat v1.37 starting...

WARNING: Hashfile '/home/opencl/hashes/customers/X/hash.txt' in line 1 ($ml$11111$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx): Line-length exception
Parsed Hashes: 1/1 (100.00%)

ERROR: No hashes loaded


RE: OSX 10.10 (-m 7100) Hash Question - atom - 11-13-2015

oclHashcat has tougher hash verification checks. Make sure your hash matches the one from the example hash page.

RE: OSX 10.10 (-m 7100) Hash Question - ZappedComet - 11-13-2015

I'd goofed with the example hash (left a whitespace, now it works). Mine still doesn't. I'll admit I don't know enough about the hashing algorithms to say if this makes a difference or not, but:

Example Hash:
* Iterations: 35460
* Salt Length: 64
* Entropy Length: 128 characters

My Hash:
* Iterations: 42735
* Salt Length: 92
* Entropy Length: 346

Would that be what could cause the line length exception?

RE: OSX 10.10 (-m 7100) Hash Question - atom - 11-13-2015

I'd guess invalid extraction of the hash. The Iteration count sounds good