[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130912200357.GA14416@lonestar>
Date: Fri, 13 Sep 2013 01:33:57 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-users@...ts.openwall.com
Cc: joachim.metz@...il.com
Subject: Re: assistance dmg2john.py RE: encrypted / unmounted
dmg partitions
On 09/12/13 at 02:09pm, Shia Aaron Lloyd Fisher wrote:
> If it is not mounted, it displays no logical path, I can only see the
> identifier name. What syntax should I use in Terminal to run dmg2john.py
> agains my dmg stored in "Apple_CoreStorage 150.2 GB disk0s4"?
Mac OS X 10.7.5 uses FileVault 2 for whole disk encryption which we
don't support at the moment. I am not a Mac user so the previous
statement needs to be confirmed.
We are (still) working on supporting FileVault 2 technology and JtR will
be able to crack it at some point :-)
In the meanwhile, here are some tips,
1. Try to remember the password and write down whatever you can remember
about the password (length, general structure, base words, etc).
2. Try to build a script around the "diskutil" command to do the
brute-forcing of your encrypted container (JtR can be used as
password generator for this script).
"diskutil corestorage list" should give you the UUID of the Logical
Volume.
"diskutil corestorage unlockVolume <UUID> -stdinpassphrase" command
can be used to mount a brute-force attack. Hopefully, Mac OS won't
wipe out your partition after N number of attempts ;)
3. I have read about using FileVaultMaster recovery keychain to unlock
the encrypted volume but I don't know anything about this method.
See http://tinyurl.com/CoreStorageAttacks for more information.
...
Hi Joachim,
Do you have some tips on solving this problem?
--
Dhiru
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
