hashcat/tools/metamask2hashcat.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

# Author: Gabriele 'matrix' Gristina
# Version: 1.0
# Date: Thu 12 Aug 2021 06:44:14 PM CEST
# License: MIT

# Extract metamask vault from browser and save to file, then you can use this tool
# reference: https://metamask.zendesk.com/hc/en-us/articles/360018766351-How-to-use-the-Vault-Decryptor-with-the-MetaMask-Vault-Data

import json
import argparse
import base64

def metamask_parser(file, shortdata):
  try:
    f = open(file)

    j = json.load(f)

    if 'salt' not in j or 'iv' not in j or 'data' not in j:
      print("! Invalid vault format ...")
      parser.print_help()
      exit(1)

    if((len(j['data']) > 3000) or shortdata):
      data_bin = base64.b64decode(j['data'])
      # TODO limit data to 16 bytes, we only check the first block of data, so we don't need more data.
      #  The use of smaller buffers should speedup the attack.
      #  Still the pbkdf 10k iter will be taking the most time by far probably.
      j['data'] = base64.b64encode(data_bin[0:64]).decode("ascii")

      print('$metamask-short$' + j['salt'] + '$' + j['iv'] + '$' + j['data'])
    else:
      print('$metamask$' + j['salt'] + '$' + j['iv'] + '$' + j['data'])
  except ValueError as e:
    parser.print_help()
    exit(1)

  exit(0)

if __name__ == "__main__":
  parser = argparse.ArgumentParser(description="metamask2hashcat.py extraction tool")
  parser.add_argument('--vault', required=True, help='set metamask vault (json) file from path', type=str)
  parser.add_argument('--shortdata', help='force short data, can only be used with m26610, ', action='store_true')

  args = parser.parse_args()

  if args.vault:
      metamask_parser(args.vault, args.shortdata)
  else:
      parser.print_help()
      exit(1)