1Password Master Password file location (MAC)?

[ry2019]

Hi all, 

My best friend is currently in a home after having a brain haemorrhage at the age of 32 and is able to talk a little, and write, but cannot remember everything. I'm trying, with his parents, to get into his 1password vault on his Mac, as everything is tied to it.

He has told his dad what the password is a few times now (same each time, contains special characters ) but it doesn't work and he gets frustrated when asked repeatedly and he can't remember something.
I think with the info he's given us, I could perform a mask attack.

Question is, where do I find the file on a Mac with the hashed 1Password Master password?

We have access to the Macbook, but he didn't use the Mac's Keychain, he used 1Password instead. 
We're unable to update his website, or keep his social media accounts active if we can't log in 

Any help would be much appreciated!

[philsmd]

I'm sorry to hear that.

It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:

https://discussions.agilebits.com/discus...ent_501834
https://discussions.agilebits.com/discus...ent_503342

it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.

after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnum...rd2john.py

and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).

Good luck
and all the best

---

oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheR...ohn.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)

[ry2019]

Thanks for this, really appreciate it. I'll give it a try over the Christmas break

All the best

I'm sorry to hear that.

It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:

https://discussions.agilebits.com/discus...ent_501834
https://discussions.agilebits.com/discus...ent_503342

it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.

after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnum...rd2john.py

and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).

Good luck
and all the best

---

oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheR...ohn.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)