[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAArRjcwJP5e3PBWUUMjU0+ebniot45RW7v3_3Xmz7f0nALXBNA@mail.gmail.com>
Date: Tue, 20 Sep 2011 21:57:15 +0200
From: Jean-Michel PICOD <jm@...izoku.org>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)
Le mardi 20 septembre 2011, jfoug a écrit :
> >From: Solar Designer [mailto:solar@...nwall.com <javascript:;>]
> >
> >On Tue, Sep 20, 2011 at 01:19:07PM -0500, jfoug wrote:
> >> I think that is ideal. A standard john tool (lion2john) to
> >> double base64 the input file,
> >
> >I could be wrong, but I think there's no _double_ base64 encoding on
> >actual systems. What we see at:
>
> I just went of how one of those links 'read'. It sounded like a double
> base-64. The first to decode to the xml file, the second decoded the xml
> variable contents. Now, I do not have a mac, so can not test at all to
> know
> what is right/wrong in how I interpreted what I read.
>
I can confirm that the double base64 encoding is due to plutil. Plus, you
don't need to rely on plutil to convert a plist to an xml (that will apply a
base64encode on every binary field) then parse the xml file back to
something useful.
We worked on Apple plist files (mostly Safari ones) for our projects DPAPIck
and OWADE. To deal with those files, we used the CFPropertyList project,
hosted on github. It's a pure python lib.
It can be found here : http://github.com/bencochran/CFPropertyList
I could write the script to convert the plist to a JtR file if you want but
I don't have a Lion plist file to test it...
By the way, the python script may not be the hardest part to write :-)
Jean-Michel
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
