[itunes backup 9] Password empty although cracked

[Krampas]

Hey guys,

I've run into a problem:

I've got an itunes backup 9 hash (14700) which I tried to crack.
My first try was to run it against the rockyou list. 1 sek later: Password was cracked.

Now the problem: --show doesn't display any password. It's just empty space. The password isn't " ", and itunes doesn't allow empty passwords.

Any ideas?

[undeath]

Just to make sure: it displays

Code:

[yourhash]:

right?

Do you know the correct password?

[Krampas]

Just to make sure: it displays

Code:

[yourhash]:

right?

Do you know the correct password?

exactly!
No I don't know the password.

[Mem5]

Set the output-format to HEX. Maybe a terminal print issue.

[Krampas]

Okay... I've solved it. And now I feel kinda dumb.

There where about 8 iTunes Backups. The one which produced this output was unencrypted. So no password to crack...

UUKeys iTunes Password Recovery seems to be a nice tool to get some information about an itunes backup quickly (Name of device, date, encryption status)

Although this tool tells me it can try about 3000 password / second on my computer. (I've tried an iOS >10 backup)
Don't really believe in these metrics...