-m 18300 APFS
#1
As you could read in this post I explained a walk-through for extracting the FileVault hash.
I also explained that this method wasn't working anymore since macOS 10.14 (Mojave).
The tool from JtR (apfs2john, a fork of apfs-fuse) was for the same reason not working anymore.

It appeared that Apple used a 4096 byte sectors in the partition table. (Read this issue on GitHub for more details)

Finally, apfs-fuse got updated and it got forked.
You'll find a working "APFS-hash-extractor" (named apfs2hashcat) on this Github: https://github.com/Banaanhangwagen/apfs2hashcat

The readme explains also the reason of multiple extracted hashes.

Happy cracking!
Reply


Messages In This Thread
-m 18300 APFS - by Banaanhangwagen - 05-01-2019, 05:47 PM
RE: -m 18300 APFS - by epixoip - 05-02-2019, 06:25 AM
RE: -m 18300 APFS - by Sondero - 05-18-2020, 10:13 AM
RE: -m 18300 APFS - by philsmd - 05-18-2020, 10:19 AM
RE: -m 18300 APFS - by Sondero - 05-18-2020, 10:30 AM
RE: -m 18300 APFS - by philsmd - 05-18-2020, 02:08 PM
RE: -m 18300 APFS - by Sondero - 05-18-2020, 02:42 PM
RE: -m 18300 APFS - by Sondero - 05-18-2020, 07:08 PM
RE: -m 18300 APFS - by hotel3068 - 09-10-2020, 10:47 PM
RE: -m 18300 APFS - by Banaanhangwagen - 09-11-2020, 02:43 PM
RE: -m 18300 APFS - by l008com - 12-02-2023, 01:26 PM
RE: -m 18300 APFS - by Banaanhangwagen - 12-02-2023, 05:44 PM
RE: -m 18300 APFS - by l008com - 12-03-2023, 01:17 AM
RE: -m 18300 APFS - by Banaanhangwagen - 12-03-2023, 02:23 AM
RE: -m 18300 APFS - by l008com - 12-03-2023, 03:19 AM
RE: -m 18300 APFS - by Grackle - 02-23-2024, 06:04 PM
RE: -m 18300 APFS - by Banaanhangwagen - 02-26-2024, 12:56 PM