10-23-2017, 01:02 PM
Hi respected Hashcat members,
Yep it's another new guy who needs some help. Hi!
I have familiarized myself with hashcat enough to run some brute force attempts on a SHA256 hash and successfully tested it.
My issue is with a crypto wallet of mine, NEO in particular. Due to some rather uninformative instructions on their website and also a bad decision of mine to make a new variation of my my password. Yes short story is I locked myself out without backing up private key.
Please hear me out as I have been working hard to try and do this myself and I thought I was on my way (i still have my modest 2x1070 rig having an attempt at a 3 day custom charset and mask brute force on my wallets password hash)
Using SQLite Db reader to open my wallet's .db3 file I found the stored passwordHash along with 2 other fields called IV and MasterKey (not sure how these other 2 come in to play) - So, bingo! i thought I found it and started my current bruteforce attempt.
I had an idea to create a new wallet file with a super simple 4 letter password - I explored this wallet db3 file, got the stored password hash and copied/pasted that into (a backup copy) of my own wallet file. Amazingly when saving it this actually worked and I was able to open my wallet through the provided neo-gui. Of course that is about all I can do though as this would be an absolutely major fault in their (NEO's) product security. No transferring my balance to a new wallet. (so close yet so far)
Having access to the features in the wallet gui i decided to run the Change Password tool. This too worked but when i checked the stored PasswordHash compared to a plain SHA256 encryption of the same password they were indeed different (salted is my guess).
So you may be asking what do I need help with ? Well the code for the wallet is open source on github and after contacting neo with no response I needed to discuss with some experts elsewhere.
Is it possible for some one on these forums to look at or assist me with the code on github and determine the hashing process for the stored passwords, im sure there is a salt used. If i can just get the salt then i can add that to my brute force attempts yeah ?
If this Forum is not the right place for this I do apologize and if someone could then contact me on email separately who may be able to help.
The github is https://github.com/neo-project/neo-gui/t...er/neo-gui (or just in case i can not yet post links its available on the neo site through the download page link)
Yep it's another new guy who needs some help. Hi!
I have familiarized myself with hashcat enough to run some brute force attempts on a SHA256 hash and successfully tested it.
My issue is with a crypto wallet of mine, NEO in particular. Due to some rather uninformative instructions on their website and also a bad decision of mine to make a new variation of my my password. Yes short story is I locked myself out without backing up private key.
Please hear me out as I have been working hard to try and do this myself and I thought I was on my way (i still have my modest 2x1070 rig having an attempt at a 3 day custom charset and mask brute force on my wallets password hash)
Using SQLite Db reader to open my wallet's .db3 file I found the stored passwordHash along with 2 other fields called IV and MasterKey (not sure how these other 2 come in to play) - So, bingo! i thought I found it and started my current bruteforce attempt.
I had an idea to create a new wallet file with a super simple 4 letter password - I explored this wallet db3 file, got the stored password hash and copied/pasted that into (a backup copy) of my own wallet file. Amazingly when saving it this actually worked and I was able to open my wallet through the provided neo-gui. Of course that is about all I can do though as this would be an absolutely major fault in their (NEO's) product security. No transferring my balance to a new wallet. (so close yet so far)
Having access to the features in the wallet gui i decided to run the Change Password tool. This too worked but when i checked the stored PasswordHash compared to a plain SHA256 encryption of the same password they were indeed different (salted is my guess).
So you may be asking what do I need help with ? Well the code for the wallet is open source on github and after contacting neo with no response I needed to discuss with some experts elsewhere.
Is it possible for some one on these forums to look at or assist me with the code on github and determine the hashing process for the stored passwords, im sure there is a salt used. If i can just get the salt then i can add that to my brute force attempts yeah ?
If this Forum is not the right place for this I do apologize and if someone could then contact me on email separately who may be able to help.
The github is https://github.com/neo-project/neo-gui/t...er/neo-gui (or just in case i can not yet post links its available on the neo site through the download page link)