Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 13 Sep 2013 01:33:57 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-users@...ts.openwall.com
Cc: joachim.metz@...il.com
Subject: Re: assistance dmg2john.py RE: encrypted / unmounted
 dmg partitions

On 09/12/13 at 02:09pm, Shia Aaron Lloyd Fisher wrote:
> If it is not mounted, it displays no logical path, I can only see the
> identifier name. What syntax should I use in Terminal to run dmg2john.py
> agains my dmg stored in "Apple_CoreStorage  150.2 GB   disk0s4"?

Mac OS X 10.7.5 uses FileVault 2 for whole disk encryption which we
don't support at the moment. I am not a Mac user so the previous
statement needs to be confirmed.

We are (still) working on supporting FileVault 2 technology and JtR will
be able to crack it at some point :-)

In the meanwhile, here are some tips,

1. Try to remember the password and write down whatever you can remember
   about the password (length, general structure, base words, etc).

2. Try to build a script around the "diskutil" command to do the
   brute-forcing of your encrypted container (JtR can be used as
   password generator for this script).

   "diskutil corestorage list" should give you the UUID of the Logical
   Volume.

   "diskutil corestorage unlockVolume <UUID> -stdinpassphrase" command
   can be used to mount a brute-force attack. Hopefully, Mac OS won't
   wipe out your partition after N number of attempts ;)

3. I have read about using FileVaultMaster recovery keychain to unlock 
   the encrypted volume but I don't know anything about this method.

   See http://tinyurl.com/CoreStorageAttacks for more information.

...

Hi Joachim,

Do you have some tips on solving this problem?

-- 
Dhiru

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.