Mac OSX Password Cracking

TL;DR: There are several ways to enumerate information from a Mac shell and to collect encrypted credentials for OSX password cracking.

Problem and Rationale

Open A Dmg File On Mac

Crack information How to use DMG Extractor 1.1.1.1 crack: A crack is a modified copy of a file that has been 'pre-hacked' by the cracker. A patch is a separate software that is applied to an installed software to generate a cracked file (EXE, DLL, etc). Davegrohl tool created in early 2011 is a password hash extractor & companion tool to John the Ripper. Sadly the development of this tool has been stopped (but could be forked.), the current status is: Dave compiles fine on Yosemite and will happily (but very slowly) crack user passwords. I have created a.dmg file with password. Unfortunately I forgot the password and I my Google searches have not resulted in a way to reset the password of this.dmg file. Please help me find a solution. I desperately need to access the contents of this.dmg file. Even if you aren't a sinister evildoer, there could be times when you need to get into a computer without the password. It's quite easy to do on a Mac, and learning how to do it can help. Spartan At the Choose a File screen, browse to and then select your password file, clicking Choose once you have done so. At the next Choose a File screen browse to and then select your dmg file which you would like to crack the password for. The password file will then be read into RAM and the password cracking will commence.

During a recent assessment the client had close to 10,000 Mac OSX systems throughout their global presence. All of these Macs were authenticating to Active Directory and allowed all logged in users local admin rights; via a misconfigured sudoers rule. Since this blog is lacking any real reference material specifically for OSX, I figured I would detail the information gathering and attacks I preformed during the assessment.

Attacks and Methodology

The default base install of Apple OSX will allow the primary user configured on that workstation to sudo to root. When Active Directory backed authentication is used, newly logged in users can inherit the primary user role if system defaults are not changed. This would effectively make all domain users local admins on all of the affected Macs. This is good news since root level permission is required to pull local password hashes.

If the OSX systems do not use AD authentication don’t fret. By default the SSH server is enabled and it does not have any lock outs on failed login attempts. If all else fails, physical attacks still work very well against OSX. Just walk up to one and hold Command+S during boot to log into a single user root terminal. If the system isn’t using full disk encryption you can simply copy files over to a USB flash drive.

Once you have a terminal on a Mac, it’s good to check user and group memberships. Again, if the user is a part of the admin group they can sudo by default; and if they are part of the wheel group they are effectively root.The following is a list of useful commands to use when in a terminal:

Note: The commands above all have a target of ‘.’ or ‘localhost’. If the system is connected to Active Directory it can be queried in a similar manner.To list all Domain Admins use the following command:

If the user doesn’t have sudo or root privileges, you can try to elevate to root privileges with one of several local privilege escalation vulnerabilities. Some recent noteworthy options include CVE-2015-5889, CVE-2015-1130, or just use some of the Yosemite environment variables like the following:

If the device is up to date on its patches about all one can do is some file pillaging. The two things I would note are Apple scripts (.scpt) and property list (.plist) files are very popular in OSX. Both file types are stored to disk as binary files. As such they need to be converted back to ASCII, to be human readable.
To view the contents of an Apple script file use a command like:

To convert a .plist file from binary to its native XML use a command like:

How To Crack Dmg Password Macbook

Note: plutil will convert files in place, so take care to make copies of files you’re working with.Alternatively the plist files can be exfiltrated to Kali and converted to XML using the libplist-utils library. The conversion command might look something like this:

If root level access is acquired, we can go straight after the local user’s plist files. Each user’s plist file contains their individual settings and their encrypted credentials. The directory that contains all local users’ plist files is /private/var/db/dslocal/nodes/Default/users/.
If another user is currently logged into the system, the user’s keychain can be dumped by root. This will provide clear text access to all saved credentials, iCloud keys, the file vault encryption key, and the user’s clear text password. To dump the users keychain use a security command like:

WARNING: In newer versions of OSX this will generate a dialog box on the user’s screen. This will obviously alert the user and only produce usable output if the user accepts.

Mac Os X Dmg Download

OSX Password Cracking

There are several ways to gain access to the encrypted shadow data, which is needed to conduct OSX password cracking. Two of them have already been mentioned above. If you have root access preform a dscl . -read /Users/<user> or if you grab the users plist file from /private/var/db/dslocal/nodes/Default/users/ and covert it to XML, there will be a XML element called ShadowHashData. The ShadowHashData is a base64 encoded blob containing a plist file with the base64 encoded entropy, salt, and iterations within it.

Mac Os Dmg Install

Note: Before the base64 can be cleanly decoded in each of these steps, the XML elements, spaces, and line breaks will need to be removed manually.
The first step is to extract the plist file form the shadow hash data and convert it back to XML. This can be done with the following commands:

Next cleanup and convert the base64 encoded entropy to hex format. This can be done with the following commands:

Macdrug Dmg Download

Third cleanup and convert the base64 encoded salt to hex format. This can be completed with the following set of commands:

Next we can put all the hex value strings together into the following hashcat format (7100).

Lastly put that baby in hashcat as OSX v10.8/v10.9 and watch it burn.

As Always:

John The Ripper : Cracking a .DMG
Let's cut to the chase right now:
Cracking encrypted disk image, AKA DMG is feasible, but, and there are many buts, is extremely, extremely time consuming.
If you do not remember at all the password, or if you attempt to crack in 'blind mode', you will probably need to teach your kids how to do it: By the time you'll have a fighting chance, you'll be long dead.
Step 1: Write down everything you can remember about the forgotten password, i.e what you could have used, and what you are sure not to have used, i.e. never used a space or a '@' sign.

Step 1a: If you remember enough of your password, or if you are just missing trailing numbers i.e Mypassword???? >> MyPassword1234 and do not remember if it's 1234 or 4321, or 9999, Just use CrowbarDMG and a Wordlist.
For good Wordlists, go here!
If you need to create a specific wordlist (because you remember what you may have used and, most importantly, what you may have not used, go here and look for Wordlists On Demand)
Warning!: CrowbarDMG is slow!
CrowbarDMG is basically a GUI for the hdiutil command

ETA for trying 9999 passwords: About 3 hrs
99,999 passwords: About 30 hrs
999,999 passwords: About 300 hrs Or 12 days ....
Step 2: Do you know how to compile and use John The Ripper? I mean 'use it! including editing Rules, etc?

--> No? Proceed here. Read carefully. Pause. Repeat.

--> Yes! Ok, Sure?

1) Download JTR, version Bleeding Jumbo by Magnum
As of Aug 2013, it's here otherwise here

2) Compile. Don't forget to edit the Makefile and John.conf. Check for CUDA and OMP/MPI RUN. Creating a new Charset? that could be wise...

3) Run dmg2John.py to ext