Itunes Backup line length

[jbear4525]

I forgot the password to my itunes backup. I already used hex editor and got my WKPY, ITER, SALT, DPIC, and DPSL. Got that in a text file. I am getting the error "line-length exception. No hash loaded." 

c:\hashcat>hashcat64 -d 1 "manifest.txt" -14800 -a 3 ?d?d?d?d?d?d?d?d?d?d

hashcat (v4.0.1) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
* Device #1: BeaverCreek, 512/1487 MB allocatable, 4MCU
* Device #2: AMD A6-3600 APU with Radeon(tm) HD Graphics, skipped.

Hash 'manifest.txt': Line-length exception
No hashes loaded.

Started: Wed Dec 13 20:48:58 2017
Stopped: Wed Dec 13 20:48:59 2017

I should also note I have zero idea what the password may be. Don't know how many characters or capital letters or numbers. I am trying to brute force attack it. Any tips or help is appreciated as this is my first time using hashcat, though I am computer savvy.

[royce]

Try your attack against the appropriate example hash to validate your approach.

Also, be aware that -m 14800 (iTunes backup >= 10.0) is a very slow hash, so if you have no idea what it might be, beyond some basic dictionaries, it's going to be pretty slow going.

[philsmd]

Let's start with this:

Code:

Hash 'manifest.txt': Line-length exception

This message clearly says that the string "manifest.txt" is not a valid hash. This means that the character m, followed by the character a, followed by the character n, ... followed by the character t does not form a valid hash. It's very easy to understand, right?
If the error message instead says that within the hash file on line x (a number) there was a hash that was not valid, it means that a hash file was used.

In your case instead, since the file manifest.txt does not exist, the string "manifest.txt" was not a valid hash.

To extract the information from the plist file, you should use itunes_backup2hashcat.pl from https://github.com/philsmd/itunes_backup2hashcat instead. Do not try to extract it yourself if you are not 100% sure about all fields.

But the main problem, as already mentioned, is that the file manifest.txt was not found on your file system. If hashcat doesn't find the file, it tries to load the parameter as a hash directly... which failed ... and the message clearly says that it is not a valid hash

[royce]

To be fair, the error could be more clear for people who are not proficient on the command line. Though I'm not sure how to make it better, other than to make it reeeeeeally explicit, as in:

Code:

The string 'manifest.txt' appears to not be a valid hash of this type (Error: line-length exception)

[undeath]

how about

Code:

No such file and invalid hash 'file.txt': line length exception

[royce]

I see what you're getting at -- hmm, maybe "and/or" (since it can be either?)

Both of our suggestions are workarounds for the fact that the same syntax can be used both to specify a hash directly, and to specific a file containing hashes. This is pretty unusual in the command-line world; normally there would be a different flag for each type of input (or one of them would be the default, and the other would be invoked with an additional flag). Otherwise, this would be a non-issue.

[jbear4525]

When I tried using the itunes_backup2hashcat.pl I got nothing but many many lines stating failed to parse hashes using the "shadow" format