+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: ecryptfs hash file (/thread-5117.html)
ecryptfs hash file - steger - 01-28-2016
Hi All,
Been lurking around 2+ years and this is my first time I've been tempted in by something I havn't seen anywhere else...
In the sample hashes for hash 12200 used for eCryptFS I see the format should read:
$ecryptfs$0$1$7c95c46e82f364b3$60bba503f0a42d0c
(Sample Hashes)
Could someone please explain what I'm meant to be putting in the middle? In most other examples it will state 'hash' 'salt' etc. in the left hand column and I feel I'm really missing something here...
I have found the very useful tool 'eCryptfs parser' at htps://sourceforge.net/projects/ecryptfs-p/ so if someone can explain what is where I can do a bit more testing
RE: ecryptfs hash file - stepMode - 01-28-2016
I'm not entirly sure what you are talking about but here is a link that kinda explains how eCryptFS works
http://cybermashup.com/2015/08/25/how-to-crack-ubuntu-disk-encryption-and-passwords/
RE: ecryptfs hash file - epixoip - 01-28-2016
steger, you need to use a scraper to get the "hash."
https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/run/ecryptfs2john.py