|
Search Results
|
| Post |
Author |
Forum |
Replies |
Views
[asc]
|
Posted |
| |
|
Thread: OSX 10.11 Hash HELP!
Post: RE: OSX 10.11 Hash HELP!
| Look at https://hashcat.net/wiki/doku.php?id=example_hashes
You'll see that your entropy is too long. You only need 64 bytes there (and not 128)
Cut it off, and it will work. |
|
Karamba |
hashcat
|
4 |
13,199 |
09-07-2018, 02:58 PM |
| |
|
Thread: OSX 10.11 Hash HELP!
Post: RE: OSX 10.11 Hash HELP!
| A byte is represented by two hexadecimal digits. So, when looking at your given entropy, the first byte is 0F.
As I mentioned higher, you need to take 64 bytes (= 128 hexadecimal digits) and not the ... |
|
Karamba |
hashcat
|
4 |
13,199 |
09-07-2018, 09:01 PM |
| |
|
Thread: nOOb help
Post: RE: nOOb help
| The hash you want to crack is stored in the [USER].plist file. You can find it in this path: /var/db/dslocal/nodes/Default/users/
Run this script (https://gist.github.com/nueh/8252572) to extract t... |
|
Karamba |
hashcat
|
12 |
8,104 |
01-04-2019, 04:34 PM |
| |
|
Thread: nOOb help
Post: RE: nOOb help
| No.
You need to execute the script which is written in python. (you can simply download it from the link that I posted)
You can run the script in Windows, Win Subsystem for Linux or any other Linu... |
|
Karamba |
hashcat
|
12 |
8,104 |
01-07-2019, 12:32 PM |
| |
|
Thread: -m 16700 Filevault
Post: -m 16700 Filevault
| A couple of days ago I read the tweet that -m 16700 Filevault is now supported.
Many thanks for this, because it has been a long time on the wish-list for many, including myself.
Now, maybe I miss... |
|
Karamba |
hashcat
|
8 |
7,670 |
06-29-2018, 04:11 PM |
| |
|
Thread: -m 16700 Filevault
Post: RE: -m 16700 Filevault
| After a lot of messing around, I got it working. It only works for Filevault on HFS+ filesystem, and not on the newest APFS.
For educational purposes, I'll post the steps that I followed (on a mac)... |
|
Karamba |
hashcat
|
8 |
7,670 |
07-31-2018, 03:04 PM |
| |
|
Thread: -m 16700 Filevault
Post: RE: -m 16700 Filevault
| Little update:
-m 16700 works also for Filevault on latest APFS filesystem, but only on macOS High Sierra (10.13)
Simply follow the guide of this fork (https://github.com/kholia/apfs2john) in orde... |
|
Karamba |
hashcat
|
8 |
7,670 |
12-21-2018, 02:54 PM |
| |
|
Thread: -m 16700 Filevault
Post: RE: -m 16700 Filevault
| mmls and others are part of the Sleuthkit; it can easily be installed on a mac via brew
if you have the drive physically attached, why not simply search with diskutil list for the RecoveryHD and mo... |
|
Karamba |
hashcat
|
8 |
7,670 |
12-26-2018, 07:14 PM |
| |
|
Thread: Ransomware
Post: RE: Ransomware
| Did you also check https://www.nomoreransom.org/ ; they have a couple of solutions; maybe you're lucky |
|
Karamba |
hashcat
|
13 |
7,570 |
12-14-2018, 11:38 AM |
| |
|
Thread: Ransomware
Post: RE: Ransomware
| It seems that JtR has it under construction.
https://github.com/magnumripper/JohnTheRipper/pull/3531 |
|
Karamba |
hashcat
|
13 |
7,570 |
12-21-2018, 08:42 AM |
| |
|
Thread: hashcat approved gpu driver no longer available
Post: RE: hashcat approved gpu driver no longer availabl...
| My experience:
System with Linux (Debian9) + Nvidia
This guide (https://www.unix-ninja.com/p/Building_a_Password_Cracking_Rig_for_Hashcat_-_Part_III)did the trick (+ some finetuning) without any pr... |
|
Karamba |
hashcat
|
9 |
6,017 |
08-08-2018, 10:59 AM |
| |
|
Thread: hashcat approved gpu driver no longer available
Post: RE: hashcat approved gpu driver no longer availabl...
| Win10 + AMD
- After installing latest driver from AMD-website (Adrenalin edition v18.x), the cards (RX570) where detected by the system, drivers were correctly installed, but cards didn't work; in de... |
|
Karamba |
hashcat
|
9 |
6,017 |
08-08-2018, 02:01 PM |
| |
|
Thread: Running maskprocessor on Mac
Post: RE: Running maskprocessor on Mac
| You have a wordlist to try and some rules. Easy.
Did you read the --help ?
At the bottom, you'll find 'Basic Examples'. Example 2 talks about wordlist + rules.
I am sure you can figure out now... |
|
Karamba |
hashcat
|
8 |
5,376 |
01-07-2019, 09:36 PM |
| |
|
Thread: Running maskprocessor on Mac
Post: RE: Running maskprocessor on Mac
| As you can read here https://hashcat.net/wiki/, next to rule-based-attack, you'll see that rules only apply for attack 0, 6 an 7. |
|
Karamba |
hashcat
|
8 |
5,376 |
01-08-2019, 08:11 AM |
| |
|
Thread: Problem with 11300
Post: RE: Problem with 11300
| (version 5?)
try version 3.6.0 |
|
Karamba |
hashcat
|
10 |
5,229 |
09-26-2018, 11:43 AM |
| |
|
Thread: how to crack a windows 10 local user password hash(Netnlm capture)
Post: RE: how to crack a windows 10 local user password ...
| hashcat.exe --help
or literally the first result:
https://www.google.com/search?q=hashcat+help
please try harder 🤨 |
|
Karamba |
hashcat
|
14 |
4,710 |
08-12-2019, 09:39 PM |
| |
|
Thread: Mac OSX Mojave .plist format conversion
Post: RE: Mac OSX Mojave .plist format conversion
| Can you elaborate on what you are trying to do?
The file AdminUserRecoveryInfo.plist is found in /Volumes/Preboot/[UUID]/var/db, and it's not the correct file in order to extract the login-hash.
T... |
|
Karamba |
hashcat
|
9 |
4,498 |
06-03-2019, 04:27 PM |
| |
|
Thread: Mac OSX Mojave .plist format conversion
Post: RE: Mac OSX Mojave .plist format conversion
| I am confused by your explanation, culdesac. Would it be possible that you are mixing things up?
I have macOS 10.14.5 installed and the known technique to recover the user-hash is perfectly working. Y... |
|
Karamba |
hashcat
|
9 |
4,498 |
06-14-2019, 11:30 PM |
| |
|
Thread: Mac OSX Mojave .plist format conversion
Post: RE: Mac OSX Mojave .plist format conversion
| I think I understand what you mean know.
You need to crack the Filevault2 encryption first. See this post. (https://hashcat.net/forum/thread-8338.html)
Once you got it, you can mount the Macintosh... |
|
Karamba |
hashcat
|
9 |
4,498 |
06-18-2019, 09:22 AM |
| |
|
Thread: Mac OSX Mojave .plist format conversion
Post: RE: Mac OSX Mojave .plist format conversion
|
laxstor Wrote: (06-25-2019, 08:29 PM)
--
culdesac I was just wondering this myself.. no way for me to get the plist via /var/db/... as that returns not permitted or permission denied.
--
Work with s... |
|
Karamba |
hashcat
|
9 |
4,498 |
06-25-2019, 09:28 PM |
