Mac OS X 10.8-9 Issue
#1
Dear hashcat developers,

I have an issue trying to crack a password stored in PBKDF2 (Salted SHA-512). The code number for this algorithm is "7100".

The information is extracted from the binary property list of the user where the attribute SALTED-SHA512-PBKDF2 is another binary property list. The information extracted for a password "abcd" is this:

- The iterations are 37313.
- Shalt is fa6cac1869263baa85cffc5e77a3d4ee164b75536cae26ce8547108f60e3f554.
- Entropy is
a731XXXXeXXXXXXXXXXXXXXXXXXXXceafc083c6bcxxxxxxxxxxxxxxxxxxxxe4625ef113b66f3xxxxxxxxxxxxxxxxxxxxxxdb3f7f14917XXXXXXXXXXXXX0aba2064XXXXX345d98c0c9a411bfd1144dd4b3c4XXXXXXX8b66d5b9abXXXXXXXXX2e103928ef21db6e25b536a60ff1XXXXXXX5be3aa7ba3a4c16b3XXXXXXXX66XXX78.

Then the result is:
$ml$37313$fa6cac1869263baa85cffc5e77a3d4ee164b75536cae26ce8547108f60e3f554$a731XXXXeXXXXXXXXXXXXXXXXXXXXceafc083c6bcxxxxxxxxxxxxxxxxxxxxe4625ef113b66f3xxxxxxxxxxxxxxxxxxxxxxdb3f7f14917XXXXXXXXXXXXX0aba2064XXXXX345d98c0c9a411bfd1144dd4b3c4XXXXXXX8b66d5b9abXXXXXXXXX2e103928ef21db6e25b536a60ff1XXXXXXX5be3aa7ba3a4c16b3XXXXXXXX66XXX78

First of all, the Mac OS X 10.8/0.9 hash provided as an example https://hashcat.net/wiki/doku.php?id=example_hashes has an invalid entropy. It is 256 hexadecimal characters and not 128, as you can also see here: https://hashcat.net/forum/thread-1687-po...l#pid10926.

Secondly the tool doesn't get a valid password, maybe I am doing something wrong, but using dave tool I get the valid password (so slow, 14 password/second):

root@The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali):~/mac_root# cat hash
$ml$37313$fa6cac1869263baa85cffc5e77a3d4ee164b75536cae26ce8547108f60e3f554$a731XXXXeXXXXXXXXXXXXXXXXXXXXceafc083c6bcxxxxxxxxxxxxxxxxxxxxe4625ef113b66f3xxxxxxxxxxxxxxxxxxxxxxdb3f7f14917XXXXXXXXXXXXX0aba2064XXXXX345d98c0c9a411bfd1144dd4b3c4XXXXXXX8b66d5b9abXXXXXXXXX2e103928ef21db6e25b536a60ff1XXXXXXX5be3aa7ba3a4c16b3XXXXXXXX66XXX78
root@The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali):~/mac_root# cat wordlist
a
ab
abc
abcd
abcde
root@The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali):~/mac_root# hashcat -m 7100 hash wordlist
Initializing hashcat v0.47 by atom with 8 threads and 32mb segment-size...

Added hashes from file hash: 1 (1 salts)
Activating quick-digest mode for single-hash with salt

NOTE: press enter for status-screen


Input.Mode: Dict (wordlist)
Index.....: 1/1 (segment), 5 (words), 20 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: - plains, - words
Progress..: 5/5 (100.00%)
Running...: 00:00:00:01
Estimated.: --:--:--:--

Started: Sun Feb 9 14:59:34 2014
Stopped: Sun Feb 9 14:59:35 2014
root@The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali):~/mac_root#

However the password "abcd" is in the wordlist.

Thank you.

[hashes masked by philsmd]


Messages In This Thread
Mac OS X 10.8-9 Issue - by moxilo - 02-09-2014, 05:15 PM
RE: Mac OS X 10.8-9 Issue - by philsmd - 02-09-2014, 05:27 PM
RE: Mac OS X 10.8-9 Issue - by moxilo - 02-10-2014, 02:21 AM
RE: Mac OS X 10.8-9 Issue - by philsmd - 02-11-2014, 04:19 PM