How to crack apple sparsebundle password
#1
Hi. 
I need to recover some passwords used to encrypt apple time machine archive. I found the related hash by using the dmg2john tool. 
The content of the hash looks like:
Code:
/Users/foo/Desktop/Test.dmg:$dmg$2*20*22e9247d0cd8f06b3ea29893fbdb574981efbd3a*32*7ba0f061afe9bd25000000000000000000000000000000000000000000000000*48*ca0603773f7c2c8b4bccd01590f001e0abffe12da002829698b93fb4c57f5aa43b6278c5cf1c1ed18da1064f7fc4900a*24418*4608*0362d58dbdddaf46774203022cbf95697ec96e9cf465fe657551948a212e0aed2ed8829c360360d9f2ec2fb8abe64
... many chars ...
593db9d5c79f340c689c515d4bf9260b04ead1a273ee8cd8763c8f4f8eb49eaa6894ae0207bf678a8a2220727b2f079223462f9071451b1bd45967c392ced9b6941e8b*1*db224728e6cf8e00765594f4b9138e930caa24a66bacc473aa93e202d71daaecece0f2ff868f8c0b5d8a78ce733bcfa7c6adb20557c5be9e92fef9ee77b9bd71ba
... many chars ...
7237792ec388dcdf91babca760ccd057fe4598176a867605ed972a413956f50a74b17134f166a3d3af73b696cac6213f1b09dbd*434782::::Test.dmg

Can someone help to format the hash and configure hashcat to search for the password?
Thanks!
Reply
#2
https://hashcat.net/wiki/
Reply
#3
Thanks but i need more help to get me on track. I've looked at the hash formats supported by hashcat but did not find one close to the hash format above. Is it simply possible to do what i want?
Reply
#4
(09-01-2023, 03:47 PM)manubb Wrote: Thanks but i need more help to get me on track. I've looked at the hash formats supported by hashcat but did not find one close to the hash format above. Is it simply possible to do what i want?

This hash is not support by hashcat you must use john the ripper to crack it.
Reply
#5
Thanks @marc1n
Reply