01-18-2017, 08:30 PM
In the manifest.plist file there are attributes in the keybag to derive the password. All the attributes (wpky, salt, iter etc) are pretty easy to parse. There is the header, followed by 00 00 00. The next offset is the length of the attribute which always seems to run neatly up to the next attribute.
My iTunes pw is 4589.
The iterations are 10000
The wkey (the last wkey in the keybag) is: 1D C1 F4 BA 48 44 D6 79 00 01 F1 45 05 91 32 18 73 C6 1D F3 66 61 12 CE 59 48 BF 93 BB C5 1E C9 00 9B ED 68 1D 0F 67 92
The salt is: 1F 90 BE 09 15 9A 77 21 54 D9 95 F3 93 14 41 83 67 C3 E3 3F
I know that each of those hex bites are required and if any are compromised Elcomsoft can't get the password. I believe this pw to be PBKDF2-HMAC-SHA1.
This should be all the data required to get the pw, if anyone can figure out how to input this to hashcat we may be done here. I tried a few variations like converting it to base64 but no luck. It looks too long.
H5C+CRWadyFU2ZXzkxRBg2fD4z8=:HcH0ukhE1nkAAfFFBZEyGHPGHfNmYRLOWUi/k7vFHskAm+1oHQ9nkg==
My iTunes pw is 4589.
The iterations are 10000
The wkey (the last wkey in the keybag) is: 1D C1 F4 BA 48 44 D6 79 00 01 F1 45 05 91 32 18 73 C6 1D F3 66 61 12 CE 59 48 BF 93 BB C5 1E C9 00 9B ED 68 1D 0F 67 92
The salt is: 1F 90 BE 09 15 9A 77 21 54 D9 95 F3 93 14 41 83 67 C3 E3 3F
I know that each of those hex bites are required and if any are compromised Elcomsoft can't get the password. I believe this pw to be PBKDF2-HMAC-SHA1.
This should be all the data required to get the pw, if anyone can figure out how to input this to hashcat we may be done here. I tried a few variations like converting it to base64 but no luck. It looks too long.
H5C+CRWadyFU2ZXzkxRBg2fD4z8=:HcH0ukhE1nkAAfFFBZEyGHPGHfNmYRLOWUi/k7vFHskAm+1oHQ9nkg==