01-27-2017, 10:19 PM
01-27-2017, 11:27 PM
(01-27-2017, 10:19 PM)epixoip Wrote: [ -> ]Try running it without Device #2
That helps a bit, thanks, but still some bugs. Looks like the issue is primarily with mode 14800. Mode 14700 (iOS 9-style backups) works well:
Code:
$ cat itunes-9.txt
$itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e**
$ cat mylist
password1
password2
test123
badpassword
$ ~/Hack/hashcat/hashcat -m 14700 -d3 --weak-hash-threshold 0 itunes-9.txt mylist
hashcat (v3.30-55-g32e285f) starting...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped
* Device #2: Iris Pro, skipped
* Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
...
$itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e**:test123
Session..........: hashcat
Status...........: Cracked
Hash.Type........: iTunes Backup < 10.0
Hash.Target......: $itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e**
Time.Started.....: Fri Jan 27 16:15:13 2017 (1 sec)
Time.Estimated...: Fri Jan 27 16:15:14 2017 (0 secs)
Input.Base.......: File (mylist)
Input.Queue......: 1/1 (100.00%)
Speed.Dev.#3.....: 0 H/s (0.56ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 4/4 (100.00%)
Rejected.........: 0/4 (0.00%)
Restore.Point....: 0/4 (0.00%)
Candidates.#3....: password1 -> badpassword
Started: Fri Jan 27 16:15:12 2017
Stopped: Fri Jan 27 16:15:14 2017Mode 14700's benchmark feature also works OK:
Code:
$ ~/Hack/hashcat/hashcat -m 14700 -d3 -b
hashcat (v3.30-55-g32e285f) starting in benchmark mode...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped
* Device #2: Iris Pro, skipped
* Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU
Hashtype: iTunes Backup < 10.0
Speed.Dev.#3.....: 2521 H/s (80.81ms)
Started: Fri Jan 27 16:22:36 2017
Stopped: Fri Jan 27 16:22:44 2017With iOS 10 however, it takes 4.5 minutes to crack the password:
Code:
$ ~/Hack/hashcat/hashcat -m 14800 -d3 --weak-hash-threshold 0 itunes-10.txt mylist
hashcat (v3.30-55-g32e285f) starting...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped
* Device #2: Iris Pro, skipped
* Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
Cache-hit dictionary stats mylist: 40 bytes, 4 words, 4 keyspace
The wordlist or mask you are using is too small.
Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_to_create_more_work_for_full_speed
INFO: approaching final keyspace, workload adjusted
$itunes_backup$*10*deff6d646eb1fa2b6741efee8b70eda84341a838cef2bb10e582669759d7e33c399a0ba2a52cb9ec*10000*f09cfa82cc1695657cb2c347ee127c2523795fda*10000000*66f159e15f3ddbbdd4057f8babef7ad4472fac10:test123
Session..........: hashcat
Status...........: Cracked
Hash.Type........: iTunes Backup >= 10.0
Hash.Target......: $itunes_backup$*10*deff6d646eb1fa2b6741efee8b70eda84341a838cef2bb10e582669759d7e33c399a0ba2a52cb9ec*10000*f09cfa82cc1695657cb2c347ee127c2523795fda*10000000*66f159e15f3ddbbdd4057f8babef7ad4472fac10
Time.Started.....: Fri Jan 27 16:17:15 2017 (4 mins, 28 secs)
Time.Estimated...: Fri Jan 27 16:21:43 2017 (0 secs)
Input.Base.......: File (mylist)
Input.Queue......: 1/1 (100.00%)
Speed.Dev.#3.....: 0 H/s (6.42ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 4/4 (100.00%)
Rejected.........: 0/4 (0.00%)
Restore.Point....: 0/4 (0.00%)
Candidates.#3....: password1 -> badpassword
Started: Fri Jan 27 16:17:14 2017
Stopped: Fri Jan 27 16:21:44 2017And the benchmark feature shows 0 H/s:
Code:
$ ~/Hack/hashcat/hashcat -m 14800 -d3 -b | grep Speed
Speed.Dev.#3.....: 0 H/s (60.15ms)I think most of us are primarily interested in iOS 10 support. Any thoughts on these issues?
Thanks!
-Josh
01-27-2017, 11:38 PM
Not a bug, the speed is simply less than 1H/s (that's because they do pbkdf-hmac2-sha256 with 10 million iterations). That means the speed is not 0, but its somewhere between 0 and 1. Hashcat however does not use floating points to show the speed but integers and that's why it's round down to 0. So, it's all fine. If you have a GTX1080 you'll have ~120 H/s.
Note that it does take 4.5 minutes on your system to test 1 password, but that's not an accurate statement. It takes 4.5 minutes to test maybe a few houndret or a few thousand passwords, that's how GPU parallelizing works. It's like with Brooks's law: While it takes one woman nine months to make one baby, nine women can't make a baby in one month.
Note that it does take 4.5 minutes on your system to test 1 password, but that's not an accurate statement. It takes 4.5 minutes to test maybe a few houndret or a few thousand passwords, that's how GPU parallelizing works. It's like with Brooks's law: While it takes one woman nine months to make one baby, nine women can't make a baby in one month.
01-31-2017, 09:33 AM
Thank you all.
I have my password again!
good job
I have my password again!
good job
03-03-2017, 12:41 PM
I have a problem with my hashcat 3:30
I use hashcat with Windows 10, but does not recognize -m 14800. someone can help me
I use hashcat with Windows 10, but does not recognize -m 14800. someone can help me
03-03-2017, 03:53 PM
03-03-2017, 06:15 PM
(03-03-2017, 12:41 PM)salvonet80 Wrote: [ -> ]I have a problem with my hashcat 3:30
I use hashcat with Windows 10, but does not recognize -m 14800. someone can help me
Need to step up to the 3.40 beta.
03-03-2017, 06:31 PM
03-21-2017, 05:22 PM
Good afternoon,
I am attempting to use hashcat v3.40 in attempt to get the password for an encrypted itunes backup. I utilized itunes_backup2hashcat.pl thanks to philsmd and then used the following command:
hashcat64.exe -m 14800 --weak-hash-threshold 0 (insert pull from itunes_backup2hashcat.pl) (pwd dictionary).
This ran for approximately 10 hours and then I received a clwaitforevents(): CL_OUT_OF_RECOURSES
clenqueueReadBuffer(): CL_OUT_OF_RECOURSES
I did change the registry for windows 10 as stated in other posts
"TDrLevel"=Dword:00000000
any suggestions would be appreciated...
I am attempting to use hashcat v3.40 in attempt to get the password for an encrypted itunes backup. I utilized itunes_backup2hashcat.pl thanks to philsmd and then used the following command:
hashcat64.exe -m 14800 --weak-hash-threshold 0 (insert pull from itunes_backup2hashcat.pl) (pwd dictionary).
This ran for approximately 10 hours and then I received a clwaitforevents(): CL_OUT_OF_RECOURSES
clenqueueReadBuffer(): CL_OUT_OF_RECOURSES
I did change the registry for windows 10 as stated in other posts
"TDrLevel"=Dword:00000000
any suggestions would be appreciated...
03-22-2017, 01:25 PM
It's not a hashcat issue, it's a driver issue.