+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Developer (https://hashcat.net/forum/forum-39.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-40.html)
+--- Thread: 1Password Master Password file location (MAC)? (/thread-8799.html)
1Password Master Password file location (MAC)? - ry2019 - 11-29-2019
Hi all,
My best friend is currently in a home after having a brain haemorrhage at the age of 32 and is able to talk a little, and write, but cannot remember everything. I'm trying, with his parents, to get into his 1password vault on his Mac, as everything is tied to it.
He has told his dad what the password is a few times now (same each time, contains special characters ) but it doesn't work and he gets frustrated when asked repeatedly and he can't remember something.
I think with the info he's given us, I could perform a mask attack.
Question is, where do I find the file on a Mac with the hashed 1Password Master password?
We have access to the Macbook, but he didn't use the Mac's Keychain, he used 1Password instead.
We're unable to update his website, or keep his social media accounts active if we can't log in
Any help would be much appreciated!
RE: 1Password Master Password file location (MAC)? - philsmd - 11-29-2019
I'm sorry to hear that.
It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:
https://discussions.agilebits.com/discussion/comment/501834/#Comment_501834
https://discussions.agilebits.com/discussion/comment/503342/#Comment_503342
it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.
after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/1password2john.py
and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).
Good luck
and all the best
oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheRipper/blob/6b14c5ab47eefe15cae13c4694a8316eaacd0e8f/run/1password2john.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)
RE: 1Password Master Password file location (MAC)? - ry2019 - 11-30-2019
Thanks for this, really appreciate it. I'll give it a try over the Christmas break
All the best
(11-29-2019, 10:49 AM)philsmd Wrote: I'm sorry to hear that.
It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:
https://discussions.agilebits.com/discussion/comment/501834/#Comment_501834
https://discussions.agilebits.com/discussion/comment/503342/#Comment_503342
it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.
after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/1password2john.py
and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).
Good luck
and all the best
oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheRipper/blob/6b14c5ab47eefe15cae13c4694a8316eaacd0e8f/run/1password2john.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)