arno/hashcat
1
0
Fork 0
mirror of https://github.com/hashcat/hashcat.git synced 2024-12-25 16:08:18 +00:00
Code Issues Releases Wiki Activity

Merge pull request #994 from philsmd/master

Browse Source 
added -m 14700 = iTunes Backup < 10.0
This commit is contained in:
Jens Steube 2017-01-25 20:13:44 +01:00 committed by GitHub
commit 2f81532d0e
10 changed files with 2327 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
OpenCL/inc_types.cl
View File

@ -739,6 +739,15 @@ typedef struct luks
} luks_t; } luks_t;
typedef struct itunes_backup
{
u32 wpky[10];
u32 dpic;
u32 dpsl[5];
} itunes_backup_t;
typedef struct luks_tmp typedef struct luks_tmp
{ {
union union

1749
OpenCL/m14700.cl Normal file
View File

File diff suppressed because it is too large Load Diff

1
docs/changes.txt
View File

@ -12,6 +12,7 @@
## ##
- Added hash-mode 14600 = LUKS - Added hash-mode 14600 = LUKS
- Added hash-mode 14700 = iTunes Backup < 10.0
## ##
## Workarounds ## Workarounds

1
docs/readme.txt
View File

@ -153,6 +153,7 @@ NVidia users require "NVIDIA Driver" (367.x or later)
- OSX v10.8 - OSX v10.8
- OSX v10.9 - OSX v10.9
- OSX v10.10 - OSX v10.10
- iTunes Backup < 10
- AIX {smd5} - AIX {smd5}
- AIX {ssha1} - AIX {ssha1}
- AIX {ssha256} - AIX {ssha256}

2
extra/tab_completion/hashcat.sh
View File

@ -176,7 +176,7 @@ _hashcat ()
{ {
local VERSION=3.30 local VERSION=3.30
local HASH_MODES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 124 130 131 132 133 140 141 150 160 200 300 400 500 501 900 1000 1100 1400 1410 1420 1421 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5200 5300 5400 5500 5600 5700 5800 6000 6100 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8800 8900 9000 9100 9200 9300 9400 9500 9600 9700 9710 9720 9800 9810 9820 9900 10000 10100 10200 10300 10400 10410 10420 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11700 11800 11900 12000 12100 12200 12300 12400 12500 12600 12700 12800 12900 13000 13100 13200 13300 13400 13500 13600 13800 13900 14000 14100" local HASH_MODES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 124 130 131 132 133 140 141 150 160 200 300 400 500 501 900 1000 1100 1400 1410 1420 1421 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5200 5300 5400 5500 5600 5700 5800 6000 6100 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8800 8900 9000 9100 9200 9300 9400 9500 9600 9700 9710 9720 9800 9810 9820 9900 10000 10100 10200 10300 10400 10410 10420 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11700 11800 11900 12000 12100 12200 12300 12400 12500 12600 12700 12800 12900 13000 13100 13200 13300 13400 13500 13600 13800 13900 14000 14100 14700"
local ATTACK_MODES="0 1 3 6 7" local ATTACK_MODES="0 1 3 6 7"
local OUTFILE_FORMATS="1 2 3 4 5 6 7 8 9 10 11 12 13 14 15" local OUTFILE_FORMATS="1 2 3 4 5 6 7 8 9 10 11 12 13 14 15"
local OPENCL_DEVICE_TYPES="1 2 3" local OPENCL_DEVICE_TYPES="1 2 3"

15
include/interface.h
View File

@ -122,6 +122,15 @@ typedef struct luks
} luks_t; } luks_t;
typedef struct itunes_backup
{
u32 wpky[10];
u32 dpic;
u32 dpsl[5];
} itunes_backup_t;
typedef struct luks_tmp typedef struct luks_tmp
{ {
union union
@ -1139,6 +1148,8 @@ typedef enum display_len
DISPLAY_LEN_MAX_14100 = 16 + 1 + 16, DISPLAY_LEN_MAX_14100 = 16 + 1 + 16,
DISPLAY_LEN_MIN_14400 = 40 + 1 + 20, DISPLAY_LEN_MIN_14400 = 40 + 1 + 20,
DISPLAY_LEN_MAX_14400 = 40 + 1 + 20, DISPLAY_LEN_MAX_14400 = 40 + 1 + 20,
DISPLAY_LEN_MIN_14700 = 8 + 1 + 1 + 1 + 80 + 1 + 1 + 1 + 40 + 1,
DISPLAY_LEN_MAX_14700 = 8 + 1 + 2 + 1 + 80 + 1 + 6 + 1 + 40 + 1 + 9 + 1 + 40,
DISPLAY_LEN_MIN_99999 = 1, DISPLAY_LEN_MIN_99999 = 1,
DISPLAY_LEN_MAX_99999 = 55, DISPLAY_LEN_MAX_99999 = 55,
@ -1266,6 +1277,7 @@ typedef enum hash_type
HASH_TYPE_DES = 53, HASH_TYPE_DES = 53,
HASH_TYPE_PLAINTEXT = 54, HASH_TYPE_PLAINTEXT = 54,
HASH_TYPE_LUKS = 55, HASH_TYPE_LUKS = 55,
HASH_TYPE_ITUNES_BACKUP_9 = 56,
} hash_type_t; } hash_type_t;
@ -1445,6 +1457,7 @@ typedef enum kern_type
KERN_TYPE_LUKS_WHIRLPOOL_AES = 14651, KERN_TYPE_LUKS_WHIRLPOOL_AES = 14651,
KERN_TYPE_LUKS_WHIRLPOOL_SERPENT = 14652, KERN_TYPE_LUKS_WHIRLPOOL_SERPENT = 14652,
KERN_TYPE_LUKS_WHIRLPOOL_TWOFISH = 14653, KERN_TYPE_LUKS_WHIRLPOOL_TWOFISH = 14653,
KERN_TYPE_ITUNES_BACKUP_9 = 14700,
KERN_TYPE_PLAINTEXT = 99999, KERN_TYPE_PLAINTEXT = 99999,
} kern_type_t; } kern_type_t;
@ -1509,6 +1522,7 @@ typedef enum rounds_count
ROUNDS_KEEPASS = 6000, ROUNDS_KEEPASS = 6000,
ROUNDS_ZIP2 = 1000, ROUNDS_ZIP2 = 1000,
ROUNDS_LUKS = 163044, // this equal to jtr -test ROUNDS_LUKS = 163044, // this equal to jtr -test
ROUNDS_ITUNES_BACKUP = 10000,
ROUNDS_STDOUT = 0 ROUNDS_STDOUT = 0
} rounds_count_t; } rounds_count_t;
@ -1676,6 +1690,7 @@ int opencart_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_bu
int plaintext_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig); int plaintext_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
int sha1cx_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig); int sha1cx_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
int luks_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED hashconfig_t *hashconfig, const int keyslot_idx); int luks_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED hashconfig_t *hashconfig, const int keyslot_idx);
int itunes_backup_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
/** /**
* hook functions * hook functions

269
src/interface.c
View File

@ -227,6 +227,7 @@ static const char HT_14000[] = "DES (PT = $salt, key = $pass)";
static const char HT_14100[] = "3DES (PT = $salt, key = $pass)"; static const char HT_14100[] = "3DES (PT = $salt, key = $pass)";
static const char HT_14400[] = "sha1(CX)"; static const char HT_14400[] = "sha1(CX)";
static const char HT_14600[] = "LUKS"; static const char HT_14600[] = "LUKS";
static const char HT_14700[] = "iTunes Backup < 10.0";
static const char HT_99999[] = "Plaintext"; static const char HT_99999[] = "Plaintext";
static const char HT_00011[] = "Joomla < 2.5.18"; static const char HT_00011[] = "Joomla < 2.5.18";
@ -356,6 +357,7 @@ static const char SIGNATURE_SYBASEASE[] = "0xc007";
//static const char SIGNATURE_TRUECRYPT[] = "TRUE"; //static const char SIGNATURE_TRUECRYPT[] = "TRUE";
static const char SIGNATURE_ZIP2_START[] = "$zip2$"; static const char SIGNATURE_ZIP2_START[] = "$zip2$";
static const char SIGNATURE_ZIP2_STOP[] = "$/zip2$"; static const char SIGNATURE_ZIP2_STOP[] = "$/zip2$";
static const char SIGNATURE_ITUNES_BACKUP[] = "$itunes_backup$";
/** /**
* decoder / encoder * decoder / encoder
@ -13530,6 +13532,207 @@ int luks_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSE
return (PARSER_OK); return (PARSER_OK);
} }
int itunes_backup_parse_hash (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig)
{
if ((input_len < DISPLAY_LEN_MIN_14700) || (input_len > DISPLAY_LEN_MAX_14700)) return (PARSER_GLOBAL_LENGTH);
if (memcmp (SIGNATURE_ITUNES_BACKUP, input_buf, 15)) return (PARSER_SIGNATURE_UNMATCHED);
u32 hash_mode = hashconfig->hash_mode;
salt_t *salt = hash_buf->salt;
itunes_backup_t *itunes_backup = (itunes_backup_t *) hash_buf->esalt;
/**
* parse line
*/
if (input_buf[15] != '*') return (PARSER_SEPARATOR_UNMATCHED);
// version (9 or 10)
u8 *version_pos = input_buf + 15 + 1;
// WPKY
u8 *wpky_pos = (u8 *) strchr ((const char *) version_pos, '*');
if (wpky_pos == NULL) return (PARSER_SEPARATOR_UNMATCHED);
u32 version_len = wpky_pos - version_pos;
wpky_pos++;
// iterations
u8 *iter_pos = (u8 *) strchr ((const char *) wpky_pos, '*');
if (iter_pos == NULL) return (PARSER_SEPARATOR_UNMATCHED);
u32 wpky_len = iter_pos - wpky_pos;
iter_pos++;
// salt
u8 *salt_pos = (u8 *) strchr ((const char *) iter_pos, '*');
if (salt_pos == NULL) return (PARSER_SEPARATOR_UNMATCHED);
u32 iter_len = salt_pos - iter_pos;
salt_pos++;
// DPIC
u8 *dpic_pos = (u8 *) strchr ((const char *) salt_pos, '*');
if (dpic_pos == NULL) return (PARSER_SEPARATOR_UNMATCHED);
u32 salt_len = dpic_pos - salt_pos;
dpic_pos++;
// DPSL
u8 *dpsl_pos = (u8 *) strchr ((const char *) dpic_pos, '*');
if (dpsl_pos == NULL) return (PARSER_SEPARATOR_UNMATCHED);
u32 dpic_len = dpsl_pos - dpic_pos;
dpsl_pos++;
u32 dpsl_len = input_len - 15 - 1 - version_len - 1 - wpky_len - 1 - iter_len - 1 - salt_len - 1 - dpic_len - 1;
/**
* verify some data
*/
if ((version_len != 1) && (version_len != 2)) return (PARSER_SEPARATOR_UNMATCHED);
u32 version = atoi ((const char *) version_pos);
if (hash_mode == 14700)
{
if (version != 9) return (PARSER_SEPARATOR_UNMATCHED);
}
else if (hash_mode == 14800)
{
if (version != 10) return (PARSER_SEPARATOR_UNMATCHED);
}
if (wpky_len != 80) return (PARSER_HASH_LENGTH);
if (iter_len < 1) return (PARSER_SALT_ITERATION);
if (iter_len > 6) return (PARSER_SALT_ITERATION);
u32 iter = atoi ((const char *) iter_pos);
if (iter < 1) return (PARSER_SALT_ITERATION);
if (salt_len != 40) return (PARSER_SALT_LENGTH);
if (is_valid_hex_string (salt_pos, 20) == false) return (PARSER_SALT_ENCODING);
if (is_valid_hex_string (wpky_pos, 40) == false) return (PARSER_HASH_ENCODING);
u32 dpic = 0;
if (hash_mode == 14700)
{
if (dpic_len > 0) return (PARSER_SEPARATOR_UNMATCHED);
if (dpsl_len > 0) return (PARSER_SEPARATOR_UNMATCHED);
}
else if (hash_mode == 14800)
{
if (dpic_len < 1) return (PARSER_SALT_ITERATION);
if (dpic_len > 9) return (PARSER_SALT_ITERATION);
dpic = atoi ((const char *) dpic_pos);
if (dpic < 1) return (PARSER_SALT_ITERATION);
if (dpsl_len != 40) return (PARSER_SEPARATOR_UNMATCHED);
if (is_valid_hex_string (dpsl_pos, 40) == false) return (PARSER_SALT_ENCODING);
}
/**
* store data
*/
// version
salt->salt_sign[0] = (char) version;
// wpky
u32 *wpky_buf_ptr = (u32 *) itunes_backup->wpky;
wpky_buf_ptr[0] = hex_to_u32 ((const u8 *) &wpky_pos[ 0]);
wpky_buf_ptr[1] = hex_to_u32 ((const u8 *) &wpky_pos[ 8]);
wpky_buf_ptr[2] = hex_to_u32 ((const u8 *) &wpky_pos[16]);
wpky_buf_ptr[3] = hex_to_u32 ((const u8 *) &wpky_pos[24]);
wpky_buf_ptr[4] = hex_to_u32 ((const u8 *) &wpky_pos[32]);
wpky_buf_ptr[5] = hex_to_u32 ((const u8 *) &wpky_pos[40]);
wpky_buf_ptr[6] = hex_to_u32 ((const u8 *) &wpky_pos[48]);
wpky_buf_ptr[7] = hex_to_u32 ((const u8 *) &wpky_pos[56]);
wpky_buf_ptr[8] = hex_to_u32 ((const u8 *) &wpky_pos[64]);
wpky_buf_ptr[9] = hex_to_u32 ((const u8 *) &wpky_pos[72]);
wpky_buf_ptr[0] = byte_swap_32 (wpky_buf_ptr[0]);
wpky_buf_ptr[1] = byte_swap_32 (wpky_buf_ptr[1]);
wpky_buf_ptr[2] = byte_swap_32 (wpky_buf_ptr[2]);
wpky_buf_ptr[3] = byte_swap_32 (wpky_buf_ptr[3]);
wpky_buf_ptr[4] = byte_swap_32 (wpky_buf_ptr[4]);
wpky_buf_ptr[5] = byte_swap_32 (wpky_buf_ptr[5]);
wpky_buf_ptr[6] = byte_swap_32 (wpky_buf_ptr[6]);
wpky_buf_ptr[7] = byte_swap_32 (wpky_buf_ptr[7]);
wpky_buf_ptr[8] = byte_swap_32 (wpky_buf_ptr[8]);
wpky_buf_ptr[9] = byte_swap_32 (wpky_buf_ptr[9]);
// iter
salt->salt_iter = iter - 1;
// salt
u8 *salt_buf_ptr = (u8 *) salt->salt_buf;
salt_len = parse_and_store_salt (salt_buf_ptr, salt_pos, salt_len, hashconfig);
salt->salt_len = salt_len;
// dpic
if (hash_mode == 14800)
{
itunes_backup->dpic = dpic;
}
// dpsl
if (hash_mode == 14800)
{
u32 *dpsl_buf_ptr = (u32 *) itunes_backup->dpsl;
dpsl_buf_ptr[0] = hex_to_u32 ((const u8 *) &dpsl_pos[ 0]);
dpsl_buf_ptr[1] = hex_to_u32 ((const u8 *) &dpsl_pos[ 8]);
dpsl_buf_ptr[2] = hex_to_u32 ((const u8 *) &dpsl_pos[16]);
dpsl_buf_ptr[3] = hex_to_u32 ((const u8 *) &dpsl_pos[24]);
dpsl_buf_ptr[4] = hex_to_u32 ((const u8 *) &dpsl_pos[32]);
dpsl_buf_ptr[0] = byte_swap_32 (dpsl_buf_ptr[ 0]);
dpsl_buf_ptr[1] = byte_swap_32 (dpsl_buf_ptr[ 1]);
dpsl_buf_ptr[2] = byte_swap_32 (dpsl_buf_ptr[ 2]);
dpsl_buf_ptr[3] = byte_swap_32 (dpsl_buf_ptr[ 3]);
dpsl_buf_ptr[4] = byte_swap_32 (dpsl_buf_ptr[ 4]);
}
return (PARSER_OK);
}
/** /**
* hook functions * hook functions
*/ */
@ -14113,6 +14316,7 @@ char *strhashtype (const u32 hash_mode)
case 14100: return ((char *) HT_14100); case 14100: return ((char *) HT_14100);
case 14400: return ((char *) HT_14400); case 14400: return ((char *) HT_14400);
case 14600: return ((char *) HT_14600); case 14600: return ((char *) HT_14600);
case 14700: return ((char *) HT_14700);
case 99999: return ((char *) HT_99999); case 99999: return ((char *) HT_99999);
} }
@ -17030,6 +17234,46 @@ int ascii_digest (hashcat_ctx_t *hashcat_ctx, char *out_buf, const size_t out_le
{ {
snprintf (out_buf, out_len - 1, "%s", hashfile); snprintf (out_buf, out_len - 1, "%s", hashfile);
} }
else if (hash_mode == 14700)
{
// WPKY
itunes_backup_t *itunes_backups = (itunes_backup_t *) esalts_buf;
itunes_backup_t *itunes_backup = &itunes_backups[salt_pos];
u8 wpky[80 + 1];
itunes_backup->wpky[0] = byte_swap_32 (itunes_backup->wpky[0]);
itunes_backup->wpky[1] = byte_swap_32 (itunes_backup->wpky[1]);
itunes_backup->wpky[2] = byte_swap_32 (itunes_backup->wpky[2]);
itunes_backup->wpky[3] = byte_swap_32 (itunes_backup->wpky[3]);
itunes_backup->wpky[4] = byte_swap_32 (itunes_backup->wpky[4]);
itunes_backup->wpky[5] = byte_swap_32 (itunes_backup->wpky[5]);
itunes_backup->wpky[6] = byte_swap_32 (itunes_backup->wpky[6]);
itunes_backup->wpky[7] = byte_swap_32 (itunes_backup->wpky[7]);
itunes_backup->wpky[8] = byte_swap_32 (itunes_backup->wpky[8]);
itunes_backup->wpky[9] = byte_swap_32 (itunes_backup->wpky[9]);
u32_to_hex_lower (itunes_backup->wpky[0], wpky + 0);
u32_to_hex_lower (itunes_backup->wpky[1], wpky + 8);
u32_to_hex_lower (itunes_backup->wpky[2], wpky + 16);
u32_to_hex_lower (itunes_backup->wpky[3], wpky + 24);
u32_to_hex_lower (itunes_backup->wpky[4], wpky + 32);
u32_to_hex_lower (itunes_backup->wpky[5], wpky + 40);
u32_to_hex_lower (itunes_backup->wpky[6], wpky + 48);
u32_to_hex_lower (itunes_backup->wpky[7], wpky + 56);
u32_to_hex_lower (itunes_backup->wpky[8], wpky + 64);
u32_to_hex_lower (itunes_backup->wpky[9], wpky + 72);
wpky[80] = 0;
snprintf (out_buf, out_len - 1, "%s*%i*%s*%i*%s**",
SIGNATURE_ITUNES_BACKUP,
salt.salt_sign[0],
wpky,
salt.salt_iter + 1,
(char *) salt.salt_buf);
}
else if (hash_mode == 99999) else if (hash_mode == 99999)
{ {
char *ptr = (char *) digest_buf; char *ptr = (char *) digest_buf;
@ -21038,6 +21282,23 @@ int hashconfig_init (hashcat_ctx_t *hashcat_ctx)
hashconfig->dgst_pos3 = 3; hashconfig->dgst_pos3 = 3;
break; break;
case 14700: hashconfig->hash_type = HASH_TYPE_ITUNES_BACKUP_9;
hashconfig->salt_type = SALT_TYPE_EMBEDDED;
hashconfig->attack_exec = ATTACK_EXEC_OUTSIDE_KERNEL;
hashconfig->opts_type = OPTS_TYPE_PT_GENERATE_LE
| OPTS_TYPE_ST_GENERATE_LE
| OPTS_TYPE_ST_HEX;
hashconfig->kern_type = KERN_TYPE_ITUNES_BACKUP_9;
hashconfig->dgst_size = DGST_SIZE_4_4; // we actually do not have a digest
hashconfig->parse_func = itunes_backup_parse_hash;
hashconfig->opti_type = OPTI_TYPE_ZERO_BYTE
| OPTI_TYPE_SLOW_HASH_SIMD;
hashconfig->dgst_pos0 = 0;
hashconfig->dgst_pos1 = 1;
hashconfig->dgst_pos2 = 2;
hashconfig->dgst_pos3 = 3;
break;
case 99999: hashconfig->hash_type = HASH_TYPE_PLAINTEXT; case 99999: hashconfig->hash_type = HASH_TYPE_PLAINTEXT;
hashconfig->salt_type = SALT_TYPE_NONE; hashconfig->salt_type = SALT_TYPE_NONE;
hashconfig->attack_exec = ATTACK_EXEC_INSIDE_KERNEL; hashconfig->attack_exec = ATTACK_EXEC_INSIDE_KERNEL;
@ -21170,6 +21431,7 @@ int hashconfig_init (hashcat_ctx_t *hashcat_ctx)
case 13763: hashconfig->esalt_size = sizeof (tc_t); break; case 13763: hashconfig->esalt_size = sizeof (tc_t); break;
case 13800: hashconfig->esalt_size = sizeof (win8phone_t); break; case 13800: hashconfig->esalt_size = sizeof (win8phone_t); break;
case 14600: hashconfig->esalt_size = sizeof (luks_t); break; case 14600: hashconfig->esalt_size = sizeof (luks_t); break;
case 14700: hashconfig->esalt_size = sizeof (itunes_backup_t); break;
} }
// hook_salt_size // hook_salt_size
@ -21268,6 +21530,7 @@ int hashconfig_init (hashcat_ctx_t *hashcat_ctx)
case 13762: hashconfig->tmp_size = sizeof (tc_tmp_t); break; case 13762: hashconfig->tmp_size = sizeof (tc_tmp_t); break;
case 13763: hashconfig->tmp_size = sizeof (tc_tmp_t); break; case 13763: hashconfig->tmp_size = sizeof (tc_tmp_t); break;
case 14600: hashconfig->tmp_size = sizeof (luks_tmp_t); break; case 14600: hashconfig->tmp_size = sizeof (luks_tmp_t); break;
case 14700: hashconfig->tmp_size = sizeof (pbkdf2_sha1_tmp_t); break;
}; };
// hook_size // hook_size
@ -21582,6 +21845,8 @@ void hashconfig_benchmark_defaults (hashcat_ctx_t *hashcat_ctx, salt_t *salt, vo
break; break;
case 14600: salt->salt_len = LUKS_SALTSIZE; case 14600: salt->salt_len = LUKS_SALTSIZE;
break; break;
case 14700: salt->salt_len = 20;
break;
} }
// special esalt handling // special esalt handling
@ -21644,6 +21909,8 @@ void hashconfig_benchmark_defaults (hashcat_ctx_t *hashcat_ctx, salt_t *salt, vo
((luks_t *) esalt)->cipher_type = HC_LUKS_CIPHER_TYPE_AES; ((luks_t *) esalt)->cipher_type = HC_LUKS_CIPHER_TYPE_AES;
((luks_t *) esalt)->cipher_mode = HC_LUKS_CIPHER_MODE_XTS_PLAIN; ((luks_t *) esalt)->cipher_mode = HC_LUKS_CIPHER_MODE_XTS_PLAIN;
break; break;
case 14700: ((itunes_backup_t *) esalt)->dpic = 10000000;
break;
} }
// special hook salt handling // special hook salt handling
@ -21828,6 +22095,8 @@ void hashconfig_benchmark_defaults (hashcat_ctx_t *hashcat_ctx, salt_t *salt, vo
break; break;
case 14600: salt->salt_iter = ROUNDS_LUKS; case 14600: salt->salt_iter = ROUNDS_LUKS;
break; break;
case 14700: salt->salt_iter = ROUNDS_ITUNES_BACKUP - 1;
break;
} }
} }

1
src/usage.c
View File

@ -271,6 +271,7 @@ static const char *USAGE_BIG[] =
" 13200 | AxCrypt | Archives", " 13200 | AxCrypt | Archives",
" 13300 | AxCrypt in memory SHA1 | Archives", " 13300 | AxCrypt in memory SHA1 | Archives",
" 13600 | WinZip | Archives", " 13600 | WinZip | Archives",
" 14700 | iTunes Backup < 10.0 | Backup",
" 62XY | TrueCrypt | Full-Disk encryptions (FDE)", " 62XY | TrueCrypt | Full-Disk encryptions (FDE)",
" X | 1 = PBKDF2-HMAC-RipeMD160 | Full-Disk encryptions (FDE)", " X | 1 = PBKDF2-HMAC-RipeMD160 | Full-Disk encryptions (FDE)",
" X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk encryptions (FDE)", " X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk encryptions (FDE)",

241
tools/test.pl
View File

@ -45,7 +45,7 @@ my $hashcat = "./hashcat";
my $MAX_LEN = 55; my $MAX_LEN = 55;
my @modes = (0, 10, 11, 12, 20, 21, 22, 23, 30, 40, 50, 60, 100, 101, 110, 111, 112, 120, 121, 122, 125, 130, 131, 132, 133, 140, 141, 150, 160, 200, 300, 400, 500, 900, 1000, 1100, 1300, 1400, 1410, 1420, 1430, 1440, 1441, 1450, 1460, 1500, 1600, 1700, 1710, 1711, 1720, 1730, 1740, 1722, 1731, 1750, 1760, 1800, 2100, 2400, 2410, 2500, 2600, 2611, 2612, 2711, 2811, 3000, 3100, 3200, 3710, 3711, 3300, 3500, 3610, 3720, 3800, 3910, 4010, 4110, 4210, 4300, 4400, 4500, 4600, 4700, 4800, 4900, 5000, 5100, 5300, 5400, 5500, 5600, 5700, 5800, 6000, 6100, 6300, 6400, 6500, 6600, 6700, 6800, 6900, 7100, 7200, 7300, 7400, 7500, 7600, 7700, 7800, 7900, 8000, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8900, 9100, 9200, 9300, 9400, 9500, 9600, 9700, 9800, 9900, 10000, 10100, 10200, 10300, 10400, 10500, 10600, 10700, 10800, 10900, 11000, 11100, 11200, 11300, 11400, 11500, 11600, 11900, 12000, 12100, 12200, 12300, 12400, 12600, 12700, 12800, 12900, 13000, 13100, 13200, 13300, 13400, 13500, 13600, 13800, 13900, 14000, 14100, 14400, 99999); my @modes = (0, 10, 11, 12, 20, 21, 22, 23, 30, 40, 50, 60, 100, 101, 110, 111, 112, 120, 121, 122, 125, 130, 131, 132, 133, 140, 141, 150, 160, 200, 300, 400, 500, 900, 1000, 1100, 1300, 1400, 1410, 1420, 1430, 1440, 1441, 1450, 1460, 1500, 1600, 1700, 1710, 1711, 1720, 1730, 1740, 1722, 1731, 1750, 1760, 1800, 2100, 2400, 2410, 2500, 2600, 2611, 2612, 2711, 2811, 3000, 3100, 3200, 3710, 3711, 3300, 3500, 3610, 3720, 3800, 3910, 4010, 4110, 4210, 4300, 4400, 4500, 4600, 4700, 4800, 4900, 5000, 5100, 5300, 5400, 5500, 5600, 5700, 5800, 6000, 6100, 6300, 6400, 6500, 6600, 6700, 6800, 6900, 7100, 7200, 7300, 7400, 7500, 7600, 7700, 7800, 7900, 8000, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8900, 9100, 9200, 9300, 9400, 9500, 9600, 9700, 9800, 9900, 10000, 10100, 10200, 10300, 10400, 10500, 10600, 10700, 10800, 10900, 11000, 11100, 11200, 11300, 11400, 11500, 11600, 11900, 12000, 12100, 12200, 12300, 12400, 12600, 12700, 12800, 12900, 13000, 13100, 13200, 13300, 13400, 13500, 13600, 13800, 13900, 14000, 14100, 14400, 14700, 99999);
my %is_unicode = map { $_ => 1 } qw(30 40 130 131 132 133 140 141 1000 1100 1430 1440 1441 1730 1740 1731 5500 5600 8000 9400 9500 9600 9700 9800 11600 13500 13800); my %is_unicode = map { $_ => 1 } qw(30 40 130 131 132 133 140 141 1000 1100 1430 1440 1441 1730 1740 1731 5500 5600 8000 9400 9500 9600 9700 9800 11600 13500 13800);
my %less_fifteen = map { $_ => 1 } qw(500 1600 1800 2400 2410 3200 6300 7400 10500 10700); my %less_fifteen = map { $_ => 1 } qw(500 1600 1800 2400 2410 3200 6300 7400 10500 10700);
@ -2406,6 +2406,79 @@ sub verify
next unless (exists ($db->{$hash_in}) and (! defined ($db->{$hash_in}))); next unless (exists ($db->{$hash_in}) and (! defined ($db->{$hash_in})));
} }
# itunes backup 9/10
elsif (($mode == 14700) || ($mode == 14800))
{
($hash_in, $word) = split ":", $line;
my $index1 = index ($hash_in, '*');
next unless ($index1 == 15);
# signature
my $signature = substr ($hash_in, 0, $index1);
next unless ($signature eq '$itunes_backup$');
my $index2 = index ($hash_in, '*', $index1 + 1);
next unless ($index2 >= 0);
# version
my $version = substr ($hash_in, $index1 + 1, $index2 - $index1 - 1);
if ($mode == 14700)
{
next unless ($version eq "9");
}
else
{
next unless ($version eq "10");
}
$index1 = index ($hash_in, '*', $index2 + 1);
next unless ($index1 >= 0);
# wpky
my $wpky = substr ($hash_in, $index2 + 1, $index1 - $index2 - 1);
next unless (length ($wpky) == 80);
$wpky = pack ("H*", $wpky);
$index2 = index ($hash_in, '*', $index1 + 1);
next unless ($index2 >= 0);
# iterations
$iter = substr ($hash_in, $index1 + 1, $index2 - $index1 - 1);
$iter = int ($iter);
next unless ($iter > 0);
$index1 = index ($hash_in, '*', $index2 + 1);
next unless ($index1 >= 0);
# salt
$salt = substr ($hash_in, $index2 + 1, $index1 - $index2 - 1);
next unless (length ($salt) == 40);
# dpic and dpsl (for v10.x we need to do more than just skip them)
$index2 = index ($hash_in, '**', $index1 + 1);
next unless ($index2 != $index1 + 1);
$param = $wpky;
}
else else
{ {
print "ERROR: hash mode is not supported\n"; print "ERROR: hash mode is not supported\n";
@ -2707,6 +2780,14 @@ sub verify
return unless (substr ($line, 0, $len) eq $hash_out); return unless (substr ($line, 0, $len) eq $hash_out);
} }
elsif (($mode == 14700) || ($mode == 14800))
{
$hash_out = gen_hash ($mode, $word, $salt, $iter, $param);
$len = length $hash_out;
return unless (substr ($line, 0, $len) eq $hash_out);
}
else else
{ {
$hash_out = gen_hash ($mode, $word, $salt, $iter); $hash_out = gen_hash ($mode, $word, $salt, $iter);
@ -3183,6 +3264,10 @@ sub passthrough
{ {
$tmp_hash = gen_hash ($mode, $word_buf, substr ($salt_buf, 0, 20)); $tmp_hash = gen_hash ($mode, $word_buf, substr ($salt_buf, 0, 20));
} }
elsif ($mode == 14700)
{
$tmp_hash = gen_hash ($mode, $word_buf, substr ($salt_buf, 0, 40));
}
else else
{ {
print "ERROR: Unsupported hash type\n"; print "ERROR: Unsupported hash type\n";
@ -3616,7 +3701,7 @@ sub single
} }
} }
} }
elsif ($mode == 8400 || $mode == 11200) elsif ($mode == 8400 || $mode == 11200 || $mode == 14700)
{ {
for (my $i = 1; $i < 32; $i++) for (my $i = 1; $i < 32; $i++)
{ {
@ -7507,6 +7592,55 @@ END_CODE
$tmp_hash = sprintf ("%s:%s", $hash_buf, $salt_buf); $tmp_hash = sprintf ("%s:%s", $hash_buf, $salt_buf);
} }
elsif ($mode == 14700)
{
my $iterations = 10000;
if (length ($iter))
{
$iterations = int ($iter);
}
my $pbkdf2 = Crypt::PBKDF2->new
(
hasher => Crypt::PBKDF2->hasher_from_algorithm ('HMACSHA1'),
iterations => $iterations,
output_len => 32
);
$salt_buf = pack ("H*", $salt_buf);
my $key = $pbkdf2->PBKDF2 ($salt_buf, $word_buf);
my $ITUNES_BACKUP_KEY = 12008468691120727718;
my $WPKY = "\x00" x 40;
if (defined $additional_param)
{
my ($A, $R) = itunes_aes_unwrap ($key, $additional_param);
if ($A == $ITUNES_BACKUP_KEY)
{
$WPKY = itunes_aes_wrap ($key, $A, $R);
}
}
else
{
my $max_number = 18446744073709551615; # 0xffffffffffffffff
my @R;
for (my $i = 0; $i < 4; $i++)
{
$R[$i] = get_random_num (0, $max_number);
}
$WPKY = itunes_aes_wrap ($key, $ITUNES_BACKUP_KEY, \@R);
}
$tmp_hash = sprintf ("\$itunes_backup\$*9*%s*%i*%s**", unpack ("H*", $WPKY), $iterations, unpack ("H*", $salt_buf));
}
elsif ($mode == 99999) elsif ($mode == 99999)
{ {
$tmp_hash = sprintf ("%s", $word_buf); $tmp_hash = sprintf ("%s", $word_buf);
@ -9774,6 +9908,109 @@ sub wpa_prf_512
return $prf_buf; return $prf_buf;
} }
sub itunes_aes_wrap
{
my $key = shift;
my $A = shift;
my $R_l = shift;
my $k = scalar (@$R_l);
my $n = $k + 1;
my @R;
for (my $i = 0; $i < $n; $i++)
{
$R[$i] = @$R_l[$i];
}
# AES mode ECB
my $m = Crypt::Mode::ECB->new ('AES', 0);
# main wrap loop
my ($i, $j, $a);
for ($j = 0; $j <= 5; $j++)
{
for ($i = 1, $a = 0; $i <= $k; $i++, $a++)
{
my $input;
$input = pack ("Q>", $A);
$input .= pack ("Q>", $R[$a]);
my $t = $m->encrypt ($input, $key);
$A = unpack ("Q>", substr ($t, 0, 8));
$A ^= $k * $j + $i;
$R[$a] = unpack ("Q>", substr ($t, 8, 8));
}
}
my $WPKY = pack ("Q>", $A);
for (my $i = 0; $i < $k; $i++)
{
$WPKY .= pack ("Q>", $R[$i]);
}
return $WPKY;
}
sub itunes_aes_unwrap
{
my $key = shift;
my $WPKY = shift;
my @B;
for (my $i = 0; $i < length ($WPKY) / 8; $i++)
{
$B[$i] = unpack ("Q>", substr ($WPKY, $i * 8, 8));
}
my $n = scalar (@B);
my $k = $n - 1;
my @R;
for (my $i = 0; $i < $k; $i++)
{
$R[$i] = $B[$i + 1];
}
# AES mode ECB
my $m = Crypt::Mode::ECB->new ('AES', 0);
# main unwrap loop
my $A = $B[0];
my ($i, $j, $a);
for ($j = 5; $j >= 0; $j--)
{
for ($i = $k, $a = $k - 1; $i > 0; $i--, $a--)
{
my $input;
$input = pack ("Q>", $A ^ ($k * $j + $i));
$input .= pack ("Q>", $R[$a]);
my $t = $m->decrypt ($input, $key);
$A = unpack ("Q>", substr ($t, 0, 8));
$R[$a] = unpack ("Q>", substr ($t, 8, 8));
}
}
return ($A, \@R);
}
sub memcmp sub memcmp
{ {
my $str1 = shift; my $str1 = shift;

4
tools/test.sh
View File

@ -9,7 +9,7 @@ TDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# missing hash types: 5200,6251,6261,6271,6281 # missing hash types: 5200,6251,6261,6271,6281
HASH_TYPES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 125 130 131 132 133 140 141 150 160 200 300 400 500 900 1000 1100 1300 1400 1410 1420 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5300 5400 5500 5600 5700 5800 6000 6100 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8900 9100 9200 9300 9400 9500 9600 9700 9800 9900 10000 10100 10200 10300 10400 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11900 12000 12100 12200 12300 12400 12600 12800 12900 13000 13100 13200 13300 13400 13500 13600 13800 14000 14100 14400 14600 99999" HASH_TYPES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 125 130 131 132 133 140 141 150 160 200 300 400 500 900 1000 1100 1300 1400 1410 1420 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5300 5400 5500 5600 5700 5800 6000 6100 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8900 9100 9200 9300 9400 9500 9600 9700 9800 9900 10000 10100 10200 10300 10400 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11900 12000 12100 12200 12300 12400 12600 12800 12900 13000 13100 13200 13300 13400 13500 13600 13800 14000 14100 14400 14600 14700 99999"
#ATTACK_MODES="0 1 3 6 7" #ATTACK_MODES="0 1 3 6 7"
ATTACK_MODES="0 1 3 7" ATTACK_MODES="0 1 3 7"
@ -22,7 +22,7 @@ HASHFILE_ONLY="2500"
NEVER_CRACK="11600" NEVER_CRACK="11600"
SLOW_ALGOS="400 500 501 1600 1800 2100 2500 3200 5200 5800 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6251 6261 6271 6281 6300 6400 6500 6600 6700 6800 7100 7200 7400 7900 8200 8800 8900 9000 9100 9200 9300 9400 9500 9600 10000 10300 10500 10700 10900 11300 11600 11900 12000 12100 12200 12300 12400 12500 12800 12900 13000 13200 13400 13600 14600" SLOW_ALGOS="400 500 501 1600 1800 2100 2500 3200 5200 5800 6211 6212 6213 6221 6222 6223 6231 6232 6233 6241 6242 6243 6251 6261 6271 6281 6300 6400 6500 6600 6700 6800 7100 7200 7400 7900 8200 8800 8900 9000 9100 9200 9300 9400 9500 9600 10000 10300 10500 10700 10900 11300 11600 11900 12000 12100 12200 12300 12400 12500 12800 12900 13000 13200 13400 13600 14600 14700"
OPTS="--quiet --force --potfile-disable --runtime 200 --gpu-temp-disable --weak-hash-threshold=0" OPTS="--quiet --force --potfile-disable --runtime 200 --gpu-temp-disable --weak-hash-threshold=0"