EDI
JOIN US ▶▶▶
招新
EDI安全的CTF战队经常参与各大CTF比赛,了解CTF赛事。
欢迎各位师傅加入EDI,大家一起打CTF,一起进步。(诚招re crypto pwn misc方向的师傅)有意向的师傅请联系邮箱[email protected]、[email protected](带上自己的简历,简历内容包括但不限于就读学校、个人ID、擅长技术方向、历史参与比赛成绩等等。
点击蓝字 · 关注我们
01
前言
~/Library/Application Support/MobileSync/Backup/导出后发现备份文件加密了,但是在题目处提示了4位数字密码。
所以翻阅资料发现hashcat可以爆破iTunes密码。
所以我们要破解密码需要满足几个条件。
1.备份加密了
2.备份文件中包含Manifest.plist文件(备份密钥就是存放于本文件下)
3.hashcat版本3.4以上即可
满足以上3个条件时可以破解该备份文件密码
1
iTunes备份的hash格式
$itunes_backup$*<ver>*<WPKY>*<ITER>*<SALT>*<DPIC>*<DPSL>对于 10.2 之前的 iOS 版本,DPIC并且DPSL不是必需的,因此请将其留空。
$itunes_backup$*9*<WPKY>*<ITER>*<SALT>**对于 iOS 10.2 及更高版本,将需要DPIC和DPSL参数。
2
hashcat参数
iOS 版本 < 10.2 hash模式选用 -m 14700
iOS 版本 >10.2 hash模式选用 -m 14800
hashcat能破解的类型参数
# | Name | Category======+============================================================+======================================900 | MD4 | Raw Hash0 | MD5 | Raw Hash100 | SHA1 | Raw Hash1300 | SHA2-224 | Raw Hash1400 | SHA2-256 | Raw Hash10800 | SHA2-384 | Raw Hash1700 | SHA2-512 | Raw Hash17300 | SHA3-224 | Raw Hash17400 | SHA3-256 | Raw Hash17500 | SHA3-384 | Raw Hash17600 | SHA3-512 | Raw Hash6000 | RIPEMD-160 | Raw Hash600 | BLAKE2b-512 | Raw Hash11700 | GOST R 34.11-2012 (Streebog) 256-bit, big-endian | Raw Hash11800 | GOST R 34.11-2012 (Streebog) 512-bit, big-endian | Raw Hash6900 | GOST R 34.11-94 | Raw Hash17010 | GPG (AES-128/AES-256 (SHA-1($pass))) | Raw Hash5100 | Half MD5 | Raw Hash17700 | Keccak-224 | Raw Hash17800 | Keccak-256 | Raw Hash17900 | Keccak-384 | Raw Hash18000 | Keccak-512 | Raw Hash6100 | Whirlpool | Raw Hash10100 | SipHash | Raw Hash70 | md5(utf16le($pass)) | Raw Hash170 | sha1(utf16le($pass)) | Raw Hash1470 | sha256(utf16le($pass)) | Raw Hash10870 | sha384(utf16le($pass)) | Raw Hash1770 | sha512(utf16le($pass)) | Raw Hash610 | BLAKE2b-512($pass.$salt) | Raw Hash salted and/or iterated620 | BLAKE2b-512($salt.$pass) | Raw Hash salted and/or iterated10 | md5($pass.$salt) | Raw Hash salted and/or iterated20 | md5($salt.$pass) | Raw Hash salted and/or iterated3800 | md5($salt.$pass.$salt) | Raw Hash salted and/or iterated3710 | md5($salt.md5($pass)) | Raw Hash salted and/or iterated4110 | md5($salt.md5($pass.$salt)) | Raw Hash salted and/or iterated4010 | md5($salt.md5($salt.$pass)) | Raw Hash salted and/or iterated21300 | md5($salt.sha1($salt.$pass)) | Raw Hash salted and/or iterated40 | md5($salt.utf16le($pass)) | Raw Hash salted and/or iterated2600 | md5(md5($pass)) | Raw Hash salted and/or iterated3910 | md5(md5($pass).md5($salt)) | Raw Hash salted and/or iterated3500 | md5(md5(md5($pass))) | Raw Hash salted and/or iterated4400 | md5(sha1($pass)) | Raw Hash salted and/or iterated4410 | md5(sha1($pass).$salt) | Raw Hash salted and/or iterated20900 | md5(sha1($pass).md5($pass).sha1($pass)) | Raw Hash salted and/or iterated21200 | md5(sha1($salt).md5($pass)) | Raw Hash salted and/or iterated4300 | md5(strtoupper(md5($pass))) | Raw Hash salted and/or iterated30 | md5(utf16le($pass).$salt) | Raw Hash salted and/or iterated110 | sha1($pass.$salt) | Raw Hash salted and/or iterated120 | sha1($salt.$pass) | Raw Hash salted and/or iterated4900 | sha1($salt.$pass.$salt) | Raw Hash salted and/or iterated4520 | sha1($salt.sha1($pass)) | Raw Hash salted and/or iterated24300 | sha1($salt.sha1($pass.$salt)) | Raw Hash salted and/or iterated140 | sha1($salt.utf16le($pass)) | Raw Hash salted and/or iterated19300 | sha1($salt1.$pass.$salt2) | Raw Hash salted and/or iterated14400 | sha1(CX) | Raw Hash salted and/or iterated4700 | sha1(md5($pass)) | Raw Hash salted and/or iterated4710 | sha1(md5($pass).$salt) | Raw Hash salted and/or iterated21100 | sha1(md5($pass.$salt)) | Raw Hash salted and/or iterated18500 | sha1(md5(md5($pass))) | Raw Hash salted and/or iterated4500 | sha1(sha1($pass)) | Raw Hash salted and/or iterated4510 | sha1(sha1($pass).$salt) | Raw Hash salted and/or iterated5000 | sha1(sha1($salt.$pass.$salt)) | Raw Hash salted and/or iterated130 | sha1(utf16le($pass).$salt) | Raw Hash salted and/or iterated1410 | sha256($pass.$salt) | Raw Hash salted and/or iterated1420 | sha256($salt.$pass) | Raw Hash salted and/or iterated22300 | sha256($salt.$pass.$salt) | Raw Hash salted and/or iterated20720 | sha256($salt.sha256($pass)) | Raw Hash salted and/or iterated21420 | sha256($salt.sha256_bin($pass)) | Raw Hash salted and/or iterated1440 | sha256($salt.utf16le($pass)) | Raw Hash salted and/or iterated20800 | sha256(md5($pass)) | Raw Hash salted and/or iterated20710 | sha256(sha256($pass).$salt) | Raw Hash salted and/or iterated21400 | sha256(sha256_bin($pass)) | Raw Hash salted and/or iterated1430 | sha256(utf16le($pass).$salt) | Raw Hash salted and/or iterated10810 | sha384($pass.$salt) | Raw Hash salted and/or iterated10820 | sha384($salt.$pass) | Raw Hash salted and/or iterated10840 | sha384($salt.utf16le($pass)) | Raw Hash salted and/or iterated10830 | sha384(utf16le($pass).$salt) | Raw Hash salted and/or iterated1710 | sha512($pass.$salt) | Raw Hash salted and/or iterated1720 | sha512($salt.$pass) | Raw Hash salted and/or iterated1740 | sha512($salt.utf16le($pass)) | Raw Hash salted and/or iterated1730 | sha512(utf16le($pass).$salt) | Raw Hash salted and/or iterated50 | HMAC-MD5 (key = $pass) | Raw Hash authenticated60 | HMAC-MD5 (key = $salt) | Raw Hash authenticated150 | HMAC-SHA1 (key = $pass) | Raw Hash authenticated160 | HMAC-SHA1 (key = $salt) | Raw Hash authenticated1450 | HMAC-SHA256 (key = $pass) | Raw Hash authenticated1460 | HMAC-SHA256 (key = $salt) | Raw Hash authenticated1750 | HMAC-SHA512 (key = $pass) | Raw Hash authenticated1760 | HMAC-SHA512 (key = $salt) | Raw Hash authenticated11750 | HMAC-Streebog-256 (key = $pass), big-endian | Raw Hash authenticated11760 | HMAC-Streebog-256 (key = $salt), big-endian | Raw Hash authenticated11850 | HMAC-Streebog-512 (key = $pass), big-endian | Raw Hash authenticated11860 | HMAC-Streebog-512 (key = $salt), big-endian | Raw Hash authenticated28700 | Amazon AWS4-HMAC-SHA256 | Raw Hash authenticated11500 | CRC32 | Raw Checksum27900 | CRC32C | Raw Checksum28000 | CRC64Jones | Raw Checksum18700 | Java Object hashCode() | Raw Checksum25700 | MurmurHash | Raw Checksum27800 | MurmurHash3 | Raw Checksum14100 | 3DES (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack14000 | DES (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack26401 | AES-128-ECB NOKDF (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack26402 | AES-192-ECB NOKDF (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack26403 | AES-256-ECB NOKDF (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack15400 | ChaCha20 | Raw Cipher, Known-plaintext attack14500 | Linux Kernel Crypto API (2.4) | Raw Cipher, Known-plaintext attack14900 | Skip32 (PT = $salt, key = $pass) | Raw Cipher, Known-plaintext attack11900 | PBKDF2-HMAC-MD5 | Generic KDF12000 | PBKDF2-HMAC-SHA1 | Generic KDF10900 | PBKDF2-HMAC-SHA256 | Generic KDF12100 | PBKDF2-HMAC-SHA512 | Generic KDF8900 | scrypt | Generic KDF400 | phpass | Generic KDF16100 | TACACS+ | Network Protocol11400 | SIP digest authentication (MD5) | Network Protocol5300 | IKE-PSK MD5 | Network Protocol5400 | IKE-PSK SHA1 | Network Protocol25100 | SNMPv3 HMAC-MD5-96 | Network Protocol25000 | SNMPv3 HMAC-MD5-96/HMAC-SHA1-96 | Network Protocol25200 | SNMPv3 HMAC-SHA1-96 | Network Protocol26700 | SNMPv3 HMAC-SHA224-128 | Network Protocol26800 | SNMPv3 HMAC-SHA256-192 | Network Protocol26900 | SNMPv3 HMAC-SHA384-256 | Network Protocol27300 | SNMPv3 HMAC-SHA512-384 | Network Protocol2500 | WPA-EAPOL-PBKDF2 | Network Protocol2501 | WPA-EAPOL-PMK | Network Protocol22000 | WPA-PBKDF2-PMKID+EAPOL | Network Protocol22001 | WPA-PMK-PMKID+EAPOL | Network Protocol16800 | WPA-PMKID-PBKDF2 | Network Protocol16801 | WPA-PMKID-PMK | Network Protocol7300 | IPMI2 RAKP HMAC-SHA1 | Network Protocol10200 | CRAM-MD5 | Network Protocol16500 | JWT (JSON Web Token) | Network Protocol29200 | Radmin3 | Network Protocol19600 | Kerberos 5, etype 17, TGS-REP | Network Protocol19800 | Kerberos 5, etype 17, Pre-Auth | Network Protocol28800 | Kerberos 5, etype 17, DB | Network Protocol19700 | Kerberos 5, etype 18, TGS-REP | Network Protocol19900 | Kerberos 5, etype 18, Pre-Auth | Network Protocol28900 | Kerberos 5, etype 18, DB | Network Protocol7500 | Kerberos 5, etype 23, AS-REQ Pre-Auth | Network Protocol13100 | Kerberos 5, etype 23, TGS-REP | Network Protocol18200 | Kerberos 5, etype 23, AS-REP | Network Protocol5500 | NetNTLMv1 / NetNTLMv1+ESS | Network Protocol27000 | NetNTLMv1 / NetNTLMv1+ESS (NT) | Network Protocol5600 | NetNTLMv2 | Network Protocol27100 | NetNTLMv2 (NT) | Network Protocol29100 | Flask Session Cookie ($salt.$salt.$pass) | Network Protocol4800 | iSCSI CHAP authentication, MD5(CHAP) | Network Protocol8500 | RACF | Operating System6300 | AIX {smd5} | Operating System6700 | AIX {ssha1} | Operating System6400 | AIX {ssha256} | Operating System6500 | AIX {ssha512} | Operating System3000 | LM | Operating System19000 | QNX /etc/shadow (MD5) | Operating System19100 | QNX /etc/shadow (SHA256) | Operating System19200 | QNX /etc/shadow (SHA512) | Operating System15300 | DPAPI masterkey file v1 (context 1 and 2) | Operating System15310 | DPAPI masterkey file v1 (context 3) | Operating System15900 | DPAPI masterkey file v2 (context 1 and 2) | Operating System15910 | DPAPI masterkey file v2 (context 3) | Operating System7200 | GRUB 2 | Operating System12800 | MS-AzureSync PBKDF2-HMAC-SHA256 | Operating System12400 | BSDi Crypt, Extended DES | Operating System1000 | NTLM | Operating System9900 | Radmin2 | Operating System5800 | Samsung Android Password/PIN | Operating System28100 | Windows Hello PIN/Password | Operating System13800 | Windows Phone 8+ PIN/password | Operating System2410 | Cisco-ASA MD5 | Operating System9200 | Cisco-IOS $8$ (PBKDF2-SHA256) | Operating System9300 | Cisco-IOS $9$ (scrypt) | Operating System5700 | Cisco-IOS type 4 (SHA256) | Operating System2400 | Cisco-PIX MD5 | Operating System8100 | Citrix NetScaler (SHA1) | Operating System22200 | Citrix NetScaler (SHA512) | Operating System1100 | Domain Cached Credentials (DCC), MS Cache | Operating System2100 | Domain Cached Credentials 2 (DCC2), MS Cache 2 | Operating System7000 | FortiGate (FortiOS) | Operating System26300 | FortiGate256 (FortiOS256) | Operating System125 | ArubaOS | Operating System501 | Juniper IVE | Operating System22 | Juniper NetScreen/SSG (ScreenOS) | Operating System15100 | Juniper/NetBSD sha1crypt | Operating System26500 | iPhone passcode (UID key + System Keybag) | Operating System122 | macOS v10.4, macOS v10.5, macOS v10.6 | Operating System1722 | macOS v10.7 | Operating System7100 | macOS v10.8+ (PBKDF2-SHA512) | Operating System3200 | bcrypt $2*$, Blowfish (Unix) | Operating System500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating System1500 | descrypt, DES (Unix), Traditional DES | Operating System29000 | sha1($salt.sha1(utf16le($username).':'.utf16le($pass))) | Operating System7400 | sha256crypt $5$, SHA256 (Unix) | Operating System1800 | sha512crypt $6$, SHA512 (Unix) | Operating System24600 | SQLCipher | Database Server131 | MSSQL (2000) | Database Server132 | MSSQL (2005) | Database Server1731 | MSSQL (2012, 2014) | Database Server24100 | MongoDB ServerKey SCRAM-SHA-1 | Database Server24200 | MongoDB ServerKey SCRAM-SHA-256 | Database Server12 | PostgreSQL | Database Server11100 | PostgreSQL CRAM (MD5) | Database Server28600 | PostgreSQL SCRAM-SHA-256 | Database Server3100 | Oracle H: Type (Oracle 7+) | Database Server112 | Oracle S: Type (Oracle 11+) | Database Server12300 | Oracle T: Type (Oracle 12+) | Database Server7401 | MySQL $A$ (sha256crypt) | Database Server11200 | MySQL CRAM (SHA1) | Database Server200 | MySQL323 | Database Server300 | MySQL4.1/MySQL5 | Database Server8000 | Sybase ASE | Database Server8300 | DNSSEC (NSEC3) | FTP, HTTP, SMTP, LDAP Server25900 | KNX IP Secure - Device Authentication Code | FTP, HTTP, SMTP, LDAP Server16400 | CRAM-MD5 Dovecot | FTP, HTTP, SMTP, LDAP Server1411 | SSHA-256(Base64), LDAP {SSHA256} | FTP, HTTP, SMTP, LDAP Server1711 | SSHA-512(Base64), LDAP {SSHA512} | FTP, HTTP, SMTP, LDAP Server24900 | Dahua Authentication MD5 | FTP, HTTP, SMTP, LDAP Server10901 | RedHat 389-DS LDAP (PBKDF2-HMAC-SHA256) | FTP, HTTP, SMTP, LDAP Server15000 | FileZilla Server >= 0.9.55 | FTP, HTTP, SMTP, LDAP Server12600 | ColdFusion 10+ | FTP, HTTP, SMTP, LDAP Server1600 | Apache $apr1$ MD5, md5apr1, MD5 (APR) | FTP, HTTP, SMTP, LDAP Server141 | Episerver 6.x < .NET 4 | FTP, HTTP, SMTP, LDAP Server1441 | Episerver 6.x >= .NET 4 | FTP, HTTP, SMTP, LDAP Server1421 | hMailServer | FTP, HTTP, SMTP, LDAP Server101 | nsldap, SHA-1(Base64), Netscape LDAP SHA | FTP, HTTP, SMTP, LDAP Server111 | nsldaps, SSHA-1(Base64), Netscape LDAP SSHA | FTP, HTTP, SMTP, LDAP Server7700 | SAP CODVN B (BCODE) | Enterprise Application Software (EAS)7701 | SAP CODVN B (BCODE) from RFC_READ_TABLE | Enterprise Application Software (EAS)7800 | SAP CODVN F/G (PASSCODE) | Enterprise Application Software (EAS)7801 | SAP CODVN F/G (PASSCODE) from RFC_READ_TABLE | Enterprise Application Software (EAS)10300 | SAP CODVN H (PWDSALTEDHASH) iSSHA-1 | Enterprise Application Software (EAS)133 | PeopleSoft | Enterprise Application Software (EAS)13500 | PeopleSoft PS_TOKEN | Enterprise Application Software (EAS)21500 | SolarWinds Orion | Enterprise Application Software (EAS)21501 | SolarWinds Orion v2 | Enterprise Application Software (EAS)24 | SolarWinds Serv-U | Enterprise Application Software (EAS)8600 | Lotus Notes/Domino 5 | Enterprise Application Software (EAS)8700 | Lotus Notes/Domino 6 | Enterprise Application Software (EAS)9100 | Lotus Notes/Domino 8 | Enterprise Application Software (EAS)26200 | OpenEdge Progress Encode | Enterprise Application Software (EAS)20600 | Oracle Transportation Management (SHA256) | Enterprise Application Software (EAS)4711 | Huawei sha1(md5($pass).$salt) | Enterprise Application Software (EAS)20711 | AuthMe sha256 | Enterprise Application Software (EAS)22400 | AES Crypt (SHA256) | Full-Disk Encryption (FDE)27400 | VMware VMX (PBKDF2-HMAC-SHA1 + AES-256-CBC) | Full-Disk Encryption (FDE)14600 | LUKS v1 (legacy) | Full-Disk Encryption (FDE)29541 | LUKS v1 RIPEMD-160 + AES | Full-Disk Encryption (FDE)29542 | LUKS v1 RIPEMD-160 + Serpent | Full-Disk Encryption (FDE)29543 | LUKS v1 RIPEMD-160 + Twofish | Full-Disk Encryption (FDE)29511 | LUKS v1 SHA-1 + AES | Full-Disk Encryption (FDE)29512 | LUKS v1 SHA-1 + Serpent | Full-Disk Encryption (FDE)29513 | LUKS v1 SHA-1 + Twofish | Full-Disk Encryption (FDE)29521 | LUKS v1 SHA-256 + AES | Full-Disk Encryption (FDE)29522 | LUKS v1 SHA-256 + Serpent | Full-Disk Encryption (FDE)29523 | LUKS v1 SHA-256 + Twofish | Full-Disk Encryption (FDE)29531 | LUKS v1 SHA-512 + AES | Full-Disk Encryption (FDE)29532 | LUKS v1 SHA-512 + Serpent | Full-Disk Encryption (FDE)29533 | LUKS v1 SHA-512 + Twofish | Full-Disk Encryption (FDE)13711 | VeraCrypt RIPEMD160 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)13712 | VeraCrypt RIPEMD160 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)13713 | VeraCrypt RIPEMD160 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)13741 | VeraCrypt RIPEMD160 + XTS 512 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13742 | VeraCrypt RIPEMD160 + XTS 1024 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13743 | VeraCrypt RIPEMD160 + XTS 1536 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)29411 | VeraCrypt RIPEMD160 + XTS 512 bit | Full-Disk Encryption (FDE)29412 | VeraCrypt RIPEMD160 + XTS 1024 bit | Full-Disk Encryption (FDE)29413 | VeraCrypt RIPEMD160 + XTS 1536 bit | Full-Disk Encryption (FDE)29441 | VeraCrypt RIPEMD160 + XTS 512 bit + boot-mode | Full-Disk Encryption (FDE)29442 | VeraCrypt RIPEMD160 + XTS 1024 bit + boot-mode | Full-Disk Encryption (FDE)29443 | VeraCrypt RIPEMD160 + XTS 1536 bit + boot-mode | Full-Disk Encryption (FDE)13751 | VeraCrypt SHA256 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)13752 | VeraCrypt SHA256 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)13753 | VeraCrypt SHA256 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)13761 | VeraCrypt SHA256 + XTS 512 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13762 | VeraCrypt SHA256 + XTS 1024 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13763 | VeraCrypt SHA256 + XTS 1536 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)29451 | VeraCrypt SHA256 + XTS 512 bit | Full-Disk Encryption (FDE)29452 | VeraCrypt SHA256 + XTS 1024 bit | Full-Disk Encryption (FDE)29453 | VeraCrypt SHA256 + XTS 1536 bit | Full-Disk Encryption (FDE)29461 | VeraCrypt SHA256 + XTS 512 bit + boot-mode | Full-Disk Encryption (FDE)29462 | VeraCrypt SHA256 + XTS 1024 bit + boot-mode | Full-Disk Encryption (FDE)29463 | VeraCrypt SHA256 + XTS 1536 bit + boot-mode | Full-Disk Encryption (FDE)13721 | VeraCrypt SHA512 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)13722 | VeraCrypt SHA512 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)13723 | VeraCrypt SHA512 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)29421 | VeraCrypt SHA512 + XTS 512 bit | Full-Disk Encryption (FDE)29422 | VeraCrypt SHA512 + XTS 1024 bit | Full-Disk Encryption (FDE)29423 | VeraCrypt SHA512 + XTS 1536 bit | Full-Disk Encryption (FDE)13771 | VeraCrypt Streebog-512 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)13772 | VeraCrypt Streebog-512 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)13773 | VeraCrypt Streebog-512 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)13781 | VeraCrypt Streebog-512 + XTS 512 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13782 | VeraCrypt Streebog-512 + XTS 1024 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)13783 | VeraCrypt Streebog-512 + XTS 1536 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)29471 | VeraCrypt Streebog-512 + XTS 512 bit | Full-Disk Encryption (FDE)29472 | VeraCrypt Streebog-512 + XTS 1024 bit | Full-Disk Encryption (FDE)29473 | VeraCrypt Streebog-512 + XTS 1536 bit | Full-Disk Encryption (FDE)29481 | VeraCrypt Streebog-512 + XTS 512 bit + boot-mode | Full-Disk Encryption (FDE)29482 | VeraCrypt Streebog-512 + XTS 1024 bit + boot-mode | Full-Disk Encryption (FDE)29483 | VeraCrypt Streebog-512 + XTS 1536 bit + boot-mode | Full-Disk Encryption (FDE)13731 | VeraCrypt Whirlpool + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)13732 | VeraCrypt Whirlpool + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)13733 | VeraCrypt Whirlpool + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)29431 | VeraCrypt Whirlpool + XTS 512 bit | Full-Disk Encryption (FDE)29432 | VeraCrypt Whirlpool + XTS 1024 bit | Full-Disk Encryption (FDE)29433 | VeraCrypt Whirlpool + XTS 1536 bit | Full-Disk Encryption (FDE)23900 | BestCrypt v3 Volume Encryption | Full-Disk Encryption (FDE)16700 | FileVault 2 | Full-Disk Encryption (FDE)27500 | VirtualBox (PBKDF2-HMAC-SHA256 & AES-128-XTS) | Full-Disk Encryption (FDE)27600 | VirtualBox (PBKDF2-HMAC-SHA256 & AES-256-XTS) | Full-Disk Encryption (FDE)20011 | DiskCryptor SHA512 + XTS 512 bit | Full-Disk Encryption (FDE)20012 | DiskCryptor SHA512 + XTS 1024 bit | Full-Disk Encryption (FDE)20013 | DiskCryptor SHA512 + XTS 1536 bit | Full-Disk Encryption (FDE)22100 | BitLocker | Full-Disk Encryption (FDE)12900 | Android FDE (Samsung DEK) | Full-Disk Encryption (FDE)8800 | Android FDE <= 4.3 | Full-Disk Encryption (FDE)18300 | Apple File System (APFS) | Full-Disk Encryption (FDE)6211 | TrueCrypt RIPEMD160 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)6212 | TrueCrypt RIPEMD160 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)6213 | TrueCrypt RIPEMD160 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)6241 | TrueCrypt RIPEMD160 + XTS 512 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)6242 | TrueCrypt RIPEMD160 + XTS 1024 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)6243 | TrueCrypt RIPEMD160 + XTS 1536 bit + boot-mode (legacy) | Full-Disk Encryption (FDE)29311 | TrueCrypt RIPEMD160 + XTS 512 bit | Full-Disk Encryption (FDE)29312 | TrueCrypt RIPEMD160 + XTS 1024 bit | Full-Disk Encryption (FDE)29313 | TrueCrypt RIPEMD160 + XTS 1536 bit | Full-Disk Encryption (FDE)29341 | TrueCrypt RIPEMD160 + XTS 512 bit + boot-mode | Full-Disk Encryption (FDE)29342 | TrueCrypt RIPEMD160 + XTS 1024 bit + boot-mode | Full-Disk Encryption (FDE)29343 | TrueCrypt RIPEMD160 + XTS 1536 bit + boot-mode | Full-Disk Encryption (FDE)6221 | TrueCrypt SHA512 + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)6222 | TrueCrypt SHA512 + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)6223 | TrueCrypt SHA512 + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)29321 | TrueCrypt SHA512 + XTS 512 bit | Full-Disk Encryption (FDE)29322 | TrueCrypt SHA512 + XTS 1024 bit | Full-Disk Encryption (FDE)29323 | TrueCrypt SHA512 + XTS 1536 bit | Full-Disk Encryption (FDE)6231 | TrueCrypt Whirlpool + XTS 512 bit (legacy) | Full-Disk Encryption (FDE)6232 | TrueCrypt Whirlpool + XTS 1024 bit (legacy) | Full-Disk Encryption (FDE)6233 | TrueCrypt Whirlpool + XTS 1536 bit (legacy) | Full-Disk Encryption (FDE)29331 | TrueCrypt Whirlpool + XTS 512 bit | Full-Disk Encryption (FDE)29332 | TrueCrypt Whirlpool + XTS 1024 bit | Full-Disk Encryption (FDE)29333 | TrueCrypt Whirlpool + XTS 1536 bit | Full-Disk Encryption (FDE)12200 | eCryptfs | Full-Disk Encryption (FDE)10400 | PDF 1.1 - 1.3 (Acrobat 2 - 4) | Document10410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 | Document10420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2 | Document10500 | PDF 1.4 - 1.6 (Acrobat 5 - 8) | Document25400 | PDF 1.4 - 1.6 (Acrobat 5 - 8) - user and owner pass | Document10600 | PDF 1.7 Level 3 (Acrobat 9) | Document10700 | PDF 1.7 Level 8 (Acrobat 10 - 11) | Document9400 | MS Office 2007 | Document9500 | MS Office 2010 | Document9600 | MS Office 2013 | Document25300 | MS Office 2016 - SheetProtection | Document9700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Document9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Document9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Document9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Document9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Document9800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Document18400 | Open Document Format (ODF) 1.2 (SHA-256, AES) | Document18600 | Open Document Format (ODF) 1.1 (SHA-1, Blowfish) | Document16200 | Apple Secure Notes | Document23300 | Apple iWork | Document6600 | 1Password, agilekeychain | Password Manager8200 | 1Password, cloudkeychain | Password Manager9000 | Password Safe v2 | Password Manager5200 | Password Safe v3 | Password Manager6800 | LastPass + LastPass sniffed | Password Manager13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Manager29700 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) - keyfile only mode | Password Manager23400 | Bitwarden | Password Manager16900 | Ansible Vault | Password Manager26000 | Mozilla key3.db | Password Manager26100 | Mozilla key4.db | Password Manager23100 | Apple Keychain | Password Manager11600 | 7-Zip | Archive12500 | RAR3-hp | Archive23800 | RAR3-p (Compressed) | Archive23700 | RAR3-p (Uncompressed) | Archive13000 | RAR5 | Archive17220 | PKZIP (Compressed Multi-File) | Archive17200 | PKZIP (Compressed) | Archive17225 | PKZIP (Mixed Multi-File) | Archive17230 | PKZIP (Mixed Multi-File Checksum-Only) | Archive17210 | PKZIP (Uncompressed) | Archive20500 | PKZIP Master Key | Archive20510 | PKZIP Master Key (6 byte optimization) | Archive23001 | SecureZIP AES-128 | Archive23002 | SecureZIP AES-192 | Archive23003 | SecureZIP AES-256 | Archive13600 | WinZip | Archive18900 | Android Backup | Archive24700 | Stuffit5 | Archive13200 | AxCrypt 1 | Archive13300 | AxCrypt 1 in-memory SHA1 | Archive23500 | AxCrypt 2 AES-128 | Archive23600 | AxCrypt 2 AES-256 | Archive14700 | iTunes backup < 10.0 | Archive14800 | iTunes backup >= 10.0 | Archive8400 | WBB3 (Woltlab Burning Board) | Forums, CMS, E-Commerce2612 | PHPS | Forums, CMS, E-Commerce121 | SMF (Simple Machines Forum) > v1.1 | Forums, CMS, E-Commerce3711 | MediaWiki B type | Forums, CMS, E-Commerce4521 | Redmine | Forums, CMS, E-Commerce24800 | Umbraco HMAC-SHA1 | Forums, CMS, E-Commerce11 | Joomla < 2.5.18 | Forums, CMS, E-Commerce13900 | OpenCart | Forums, CMS, E-Commerce11000 | PrestaShop | Forums, CMS, E-Commerce16000 | Tripcode | Forums, CMS, E-Commerce7900 | Drupal7 | Forums, CMS, E-Commerce4522 | PunBB | Forums, CMS, E-Commerce2811 | MyBB 1.2+, IPB2+ (Invision Power Board) | Forums, CMS, E-Commerce2611 | vBulletin < v3.8.5 | Forums, CMS, E-Commerce2711 | vBulletin >= v3.8.5 | Forums, CMS, E-Commerce25600 | bcrypt(md5($pass)) / bcryptmd5 | Forums, CMS, E-Commerce25800 | bcrypt(sha1($pass)) / bcryptsha1 | Forums, CMS, E-Commerce28400 | bcrypt(sha512($pass)) / bcryptsha512 | Forums, CMS, E-Commerce21 | osCommerce, xt:Commerce | Forums, CMS, E-Commerce18100 | TOTP (HMAC-SHA1) | One-Time Password2000 | STDOUT | Plaintext99999 | Plaintext | Plaintext21600 | Web2py pbkdf2-sha512 | Framework10000 | Django (PBKDF2-SHA256) | Framework124 | Django (SHA-1) | Framework12001 | Atlassian (PBKDF2-HMAC-SHA1) | Framework19500 | Ruby on Rails Restful-Authentication | Framework27200 | Ruby on Rails Restful Auth (one round, no sitekey) | Framework30000 | Python Werkzeug MD5 (HMAC-MD5 (key = $salt)) | Framework30120 | Python Werkzeug SHA256 (HMAC-SHA256 (key = $salt)) | Framework20200 | Python passlib pbkdf2-sha512 | Framework20300 | Python passlib pbkdf2-sha256 | Framework20400 | Python passlib pbkdf2-sha1 | Framework24410 | PKCS#8 Private Keys (PBKDF2-HMAC-SHA1 + 3DES/AES) | Private Key24420 | PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES) | Private Key15500 | JKS Java Key Store Private Keys (SHA1) | Private Key22911 | RSA/DSA/EC/OpenSSH Private Keys ($0$) | Private Key22921 | RSA/DSA/EC/OpenSSH Private Keys ($6$) | Private Key22931 | RSA/DSA/EC/OpenSSH Private Keys ($1, $3$) | Private Key22941 | RSA/DSA/EC/OpenSSH Private Keys ($4$) | Private Key22951 | RSA/DSA/EC/OpenSSH Private Keys ($5$) | Private Key23200 | XMPP SCRAM PBKDF2-SHA1 | Instant Messaging Service28300 | Teamspeak 3 (channel hash) | Instant Messaging Service22600 | Telegram Desktop < v2.1.14 (PBKDF2-HMAC-SHA1) | Instant Messaging Service24500 | Telegram Desktop >= v2.1.14 (PBKDF2-HMAC-SHA512) | Instant Messaging Service22301 | Telegram Mobile App Passcode (SHA256) | Instant Messaging Service23 | Skype | Instant Messaging Service29600 | Terra Station Wallet (AES256-CBC(PBKDF2($pass))) | Cryptocurrency Wallet26600 | MetaMask Wallet | Cryptocurrency Wallet21000 | BitShares v0.x - sha512(sha512_bin(pass)) | Cryptocurrency Wallet28501 | Bitcoin WIF private key (P2PKH), compressed | Cryptocurrency Wallet28502 | Bitcoin WIF private key (P2PKH), uncompressed | Cryptocurrency Wallet28503 | Bitcoin WIF private key (P2WPKH, Bech32), compressed | Cryptocurrency Wallet28504 | Bitcoin WIF private key (P2WPKH, Bech32), uncompressed | Cryptocurrency Wallet28505 | Bitcoin WIF private key (P2SH(P2WPKH)), compressed | Cryptocurrency Wallet28506 | Bitcoin WIF private key (P2SH(P2WPKH)), uncompressed | Cryptocurrency Wallet11300 | Bitcoin/Litecoin wallet.dat | Cryptocurrency Wallet16600 | Electrum Wallet (Salt-Type 1-3) | Cryptocurrency Wallet21700 | Electrum Wallet (Salt-Type 4) | Cryptocurrency Wallet21800 | Electrum Wallet (Salt-Type 5) | Cryptocurrency Wallet12700 | Blockchain, My Wallet | Cryptocurrency Wallet15200 | Blockchain, My Wallet, V2 | Cryptocurrency Wallet18800 | Blockchain, My Wallet, Second Password (SHA256) | Cryptocurrency Wallet25500 | Stargazer Stellar Wallet XLM | Cryptocurrency Wallet16300 | Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256 | Cryptocurrency Wallet15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Cryptocurrency Wallet15700 | Ethereum Wallet, SCRYPT | Cryptocurrency Wallet22500 | MultiBit Classic .key (MD5) | Cryptocurrency Wallet27700 | MultiBit Classic .wallet (scrypt) | Cryptocurrency Wallet22700 | MultiBit HD (scrypt) | Cryptocurrency Wallet28200 | Exodus Desktop Wallet (scrypt) | Cryptocurrency Wallet
了解完工具的用法后,咱们继续过来研究制作这个hash
我一共发现两个方法,第一种
https://github.com/philsmd/itunes_backup2hashcat脚本跑出结果
VERS 3TYPE 1----------UUID: b6ed25...d71a, HMCK: 0000...0000, WRAP: 0, SALT: 2b06ba3c6281ce101a0bd0249c1203cc9c8da1a8, ITER: 10000UUID: 3a8bcc...baaf, CLAS: 11, WRAP: 3, KTYP: 0, WPKY: c1212e8754a1db6dfddc4fc6a386795eda88c18b865742e6fbd961b13e3229efda50dc0b69bdfc2eUUID: 47386f...58d1, CLAS: 10, WRAP: 3, KTYP: 0, WPKY: d025009b7eaa016d756d6862c71856e76b060e1ee6f69e6c805852008757f1cb25110025a2e4fcb6UUID: 24ac76...af0c, CLAS: 9, WRAP: 3, KTYP: 0, WPKY: baa24719f865afe330b85f26468e787c0115339407ad950935070cd5e7cc27a5d6c811e716b38741...
使用脚本后可以算出特定的hash值,还得自己去构造,所以我选择第二种使用在线网站算出hash值
https://www.onlinehashcrack.com/tools-itunes-backup-hash-extractor.php网站跑出来的hash格式
$itunes_backup$*10*537697c2cbdea2a529c07af56bb1f128d6d58adb50bae1312163af9b25797c07fe7da87f7432bde8*10000*bc9b58c8c351f7a5834aa92fe95cee9c18f6d2a2*10000000*c71867a9f4de7c4663b0ffe8fadfc6d5174d0f9bhashcat64 -m 14700 -a 3 "$itunes_backup$*9*c1212e8754a1db6dfddc4fc6a386795eda88c18b865742e6fbd961b13e3229efda50dc0b69bdfc2e*10000*2b06ba3c6281ce101a0bd0249c1203cc9c8da1a8**" ?d?d?d?d...$itunes_backup$*9*c1212e8754a1db6dfddc4fc6a386795eda88c18b865742e6fbd961b13e3229efda50dc0b69bdfc2e*10000*2b06ba3c6281ce101a0bd0249c1203cc9c8da1a8**:1234Session..........: hashcatStatus...........: CrackedHash.Type........: iTunes Backup < 10.0Hash.Target......: $itunes_backup$*9*c1212e8754a1db6dfddc4fc6a386795eda88c18b865742e6fbd961b13e3229efda50dc0b69bdfc2e*10000*2b06ba3c6281ce101a0bd0249c1203cc9c8da1a8**Time.Started.....: Thu Mar 02 22:16:09 2017 (9 secs)Time.Estimated...: Thu Mar 02 22:16:18 2017 (0 secs)Input.Mask.......: pa?l?l?l?l?l?l [8]Input.Queue......: 1/1 (100.00%)Speed.Dev.#1.....: 55659 H/s (6.43ms)Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) SaltsProgress.........: 540672/308915776 (0.18%)Rejected.........: 0/540672 (0.00%)Restore.Point....: 360448/308915776 (0.12%)Candidates.#1....: paydbfer -> panpjurdHWMon.Dev.#1.....: Temp: 47c Fan: 33% Util: 92% Core:1100Mhz Mem:1500Mhz Lanes:16
此时我们可以看到密码为:1234
延伸学习
深入的 iPhone 数据保护:http://esec-lab.sogeti.com/static/publications/11-hitbamsterdam-iphonedataprotection.pdfiphone-dataprotection code:https://code.google.com/archive/p/iphone-dataprotection/
最后讲点hashcat的工具使用方法
3
MySQL
hashcat64.exe -a 3 -m 300 --force6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 ?d?d?d?d?d?
4
Sha512
hashcat64.exe -a 3 -m 1800 --force$6$mxuA5cdy$XZRk0CvnPFqOgVopqiPEFAFK72SogKVwwwp7gWaUOb7b6tVwfCpcSUsCEk64ktLLYmzyew/xd0O0hPG/yrm2X. ?l?l?l?l
5
NT-Hash
hashcat64.exe -a 3 -m 1000209C6174DA490CAEB422F3FA5A7AE634 ?l?l?l?l?l
6
LM-Hash
hashcat64.exe -a 3 -m 3000F0D412BD764FFE81AAD3B435B51404EE ?l?l?l?l?l
7
MSSQL
hashcat64.exe -a 3 -m 132 --force0x01008c8006c224f71f6bf0036f78d863c3c4ff53f8c3c48edafb ?l?l?l?l?l?d?d?d
8
WordPress
hashcat64.exe -a 3 -m 400 --force$P$BYEYcHEj3vDhV1lwGBv6rpxurKOEWY/ ?d?d?d?d?d?d
9
DIscuz
hashcat64.exe -a 3 -m 2611 --force14e1b600b1fd579f47433b88e8d85291: ?d?d?d?d?d?d
10
RAR 密码
首先使用rar2john
rar2john.exe 1.rar之后进行破解:
hashcat64.exe -a 3 -m 13000 --force$rar5$16$639e9ce8344c680da12e8bdd4346a6a3$15$a2b056a21a9836d8d48c2844d171b73d$8$04a52d2224ad082e ?d?d?d?d?d?d
hashcat支持RAR3-hp和 RAR5
11
ZIP密码
首先使用zip2john获取文件的hash值
zip2john.exe 1.ziphashcat64.exe -a 3 -m 13600 $zip2$*0*3*0*554bb43ff71cb0cac76326f292119dfd*ff23*5*24b28885ee*d4fe362bb1e91319ab53*$/zip2$ --force ?d?d?d?d?d?d
12
Office密码
python office2john.py 11.docxhashcat64.exe -a 3 -m 9600$office$*2013*100000*256*16*e4a3eb62e8d3576f861f9eded75e0525*9eeb35f0849a7800d48113440b4bbb9c*577f8d8b2e1c5f60fed76e62327b38d28f25230f6c7dfd66588d9ca8097aabb9 --force ?d?d?d?d?d?d
13
WIFI密码
首先把我们的握手包转化为hccapx格式,现在最新版的hashcat只支持hccapx格式了,以前的hccap格式已经不支持了,官方在线转换:
https://hashcat.net/cap2hccapx/hashcat64.exe -a 3 -m 2500 1.hccapx 1391040?d?d?d?dEDI安全
扫二维码|关注我们
一个专注渗透实战经验分享的公众号