Nexus 5X PIN question

[jahaynsworth]

Greetings,
     I'm having trouble getting hashcat to produce a 4-digit PIN from a Nexus 5X. I know the PIN is 1234 (I set it), and am trying to get hashcat to give me that result. Here's the process I've taken. 

1. Hashed PIN: 2dda3898dfc93e5334cb1113748d41b24b5b293ce2c704ed395b06bf492d95fd4ad3a96f

Stored here: /data/system/password.key
Format: hash(PIN and salt)=<40 character SHA-1 hash> || <32 character MD5 hash>

2. Query database for salt: 0x 081cec9952979615 (converted from decimal)
Query database for password rules: /data/system/locksettings.db
Query password policies: length = 4, uppercase=0, lowercase=0, uppercase=0, symbols=0, numeric=4

3. Feed salt and MD5 hash into hashcat:
./hashcat.bin –m 10 e2c704ed395b06bf492d95fd4ad3a964:081cec9952979615 –a 3 ?d?d?d?d --force

4. Output is showing "exhausted", with no successful results. I know the PIN is just 1234 but I'm trying to get hashcat to

I'm running from my laptop and thought maybe there is an opencl issue, but I'm not sure. Any help would be appreciated- thanks!


Here's the actual output:

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: md5($pass.$salt)
Hash.Target......: e2c704ed395b06bf492d95fd4ad3a964:081cec9952979615
Time.Started.....: Tue Jun 05 23:01:20 2018 (0 secs)
Time.Estimated...: Tue Jun 05 23:01:20 2018 (0 secs)
Guess.Mask.......: ?d?d?d?d [4]
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:  3575.5 kH/s (0.16ms) @ Accel:16 Loops:10 Thr:256 Vec:1
Speed.Dev.#3.....:        0 H/s (0.00ms) @ Accel:16 Loops:10 Thr:256 Vec:1
Speed.Dev.#*.....:  3575.5 kH/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 10000/10000 (100.00%)
Rejected.........: 0/10000 (0.00%)
Restore.Point....: 0/1000 (0.00%)
Candidates.#1....: 1234 -> 6764
Candidates.#3....: [Generating]
HWMon.Dev.#1.....: N/A
HWMon.Dev.#3.....: N/A

Started: Tue Jun 05 23:01:17 2018
Stopped: Tue Jun 05 23:01:21 2018

[DanielG]

I think you must specify if the salt is in hex format with --hex-salt, also you seem to be using --force. That option might mask an error preventing you from successfully brute forcing this.

[jahaynsworth]

Thanks for the quick response! When I remove --force, I get an error about my GPU, but I'm on a laptop and am ok with hashcat using my CPU to crunch through the 10,000 iterations needed for the password space.

I did try the --hex-salt (and --hex-charset) modifiers but didn't see any apparent change in the results.

It would help to narrow down the trouble if someone could run my command on their machine:
hashcat64.exe -m 10 e2c704ed395b06bf492d95fd4ad3a964:081cec9952979615 -a 3 ?d?d?d?d --force --hex-salt

(or the ./hashcat64.bin equivalent) and let me know if they're getting any errors or just the cracked pin 1234.

Here's the error I get if I remove --force:
* Device #1: Intel's OpenCL runtime (GPU only) is currently broken.
We are waiting for updated OpenCL drivers from Intel.
You can use --force to override, but do not report related errors.
* Device #3: Intel's OpenCL runtime (GPU only) is currently broken.
We are waiting for updated OpenCL drivers from Intel.
You can use --force to override, but do not report related errors.
No devices found/left.

Thanks,

[DanielG]

Are you sure that the Nexus 5X stores the pin in the simple format "md5(pin + salt)"? For example I read about a Samsung phone that it is stored very differently on https://hashcat.net/forum/thread-2202.html.

If I run your hashcat commands it does not reveal pin 1234 as a result. Also if I hash it manually it shows that "1234" + "081cec9952979615" or "081cec9952979615" + "1234" does not produce your MD5 (or SHA1) hash.

[jahaynsworth]

Interesting question. I thought I understood how the Nexus 5X stored the pin, but of course I could be wrong. Thanks for running the command on your machine- I ran it on a linux box as well with the same "exhausted" result.

It make sense to try running the process as you did in reverse- to run the PIN & salt through the MD5 and SHA1 hashes to see if they come out matching. I wan't able to re-produce that either. I tried Salt(base10):PIN(base10), Salt(base16):PIN(base10), PIN(base10):salt(base10), and PIN(base10):salt(base16).

That link you posted is great. If anyone has something similar for the Nexus 5X that would be perfect.

I followed the Samsung method in that link in the hopes that maybe the 5X used the same process, but again exhausted the password space with no result.

>hashcat64.exe -a 3 -n 80 -u 1024 -m 5800 2dda3898dfc93e5334cb1113748d41b24b5b293c:081cec9952979615 ?d?d?d?d --force

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: Samsung Android Password/PIN
Hash.Target......: 2dda3898dfc93e5334cb1113748d41b24b5b293c:081cec9952979615
Time.Started.....: Thu Jun 07 08:25:37 2018 (1 sec)
Time.Estimated...: Thu Jun 07 08:25:38 2018 (0 secs)
Guess.Mask.......: ?d?d?d?d [4]
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:    12328 H/s (10715.98ms) @ Accel:80 Loops:1024 Thr:256 Vec:1
Speed.Dev.#3.....:        0 H/s (38025.56ms) @ Accel:80 Loops:1024 Thr:256 Vec:1
Speed.Dev.#*.....:    12328 H/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 10000/10000 (100.00%)
Rejected.........: 0/10000 (0.00%)
Restore.Point....: 0/1000 (0.00%)
Candidates.#1....: 6234 -> 6764
Candidates.#3....: [Generating]
HWMon.Dev.#1.....: N/A
HWMon.Dev.#3.....: N/A

Started: Thu Jun 07 08:20:31 2018
Stopped: Thu Jun 07 08:25:40 2018

[jahaynsworth]

Doing some more research, it looks like Android changed the way they stored PINs around Android 5.1. I can't find anything about how to use hashcat with anything more modern than that.