{"id":13540348,"url":"https://github.com/n0fate/chainbreaker","last_synced_at":"2025-04-02T07:30:52.553Z","repository":{"id":41443334,"uuid":"9693322","full_name":"n0fate/chainbreaker","owner":"n0fate","description":"Mac OS X Keychain Forensic Tool","archived":false,"fork":false,"pushed_at":"2023-05-19T15:42:39.000Z","size":163,"stargazers_count":863,"open_issues_count":15,"forks_count":168,"subscribers_count":37,"default_branch":"master","last_synced_at":"2025-03-12T22:00:46.414Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/n0fate.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2013-04-26T11:04:25.000Z","updated_at":"2025-03-12T20:57:17.000Z","dependencies_parsed_at":"2024-01-12T03:36:24.952Z","dependency_job_id":"3d7bfd8f-a92a-4db6-9ff9-220ba6c29cc9","html_url":"https://github.com/n0fate/chainbreaker","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n0fate%2Fchainbreaker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n0fate%2Fchainbreaker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n0fate%2Fchainbreaker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n0fate%2Fchainbreaker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/n0fate","download_url":"https://codeload.github.com/n0fate/chainbreaker/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246774279,"owners_count":20831504,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:47.352Z","updated_at":"2025-04-02T07:30:48.597Z","avatar_url":"https://github.com/n0fate.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"e1fc1d87056438f82268742dc2ba08f5\"\u003e\u003c/a\u003e事件响应\u0026\u0026取证\u0026\u0026内存取证\u0026\u0026数字取证","Python","\u003ca id=\"9c0413531a5b5afd12b89ccdc744afbd\"\u003e\u003c/a\u003emacOS"],"sub_categories":["\u003ca id=\"1fc5d3621bb13d878f337c8031396484\"\u003e\u003c/a\u003e取证\u0026\u0026Forensics\u0026\u0026数字取证\u0026\u0026内存取证"],"readme":"Chainbreaker\n============\nChainbreaker can be used to extract the following types of information from an OSX keychain in a forensically sound manner: \n\n* Hashed Keychain password, suitable for cracking with [hashcat](https://hashcat.net/hashcat/) or\n [John the Ripper](https://www.openwall.com/john/)\n* Internet Passwords\n* Generic Passwords\n* Private Keys\n* Public Keys\n* X509 Certificates\n* Secure Notes\n* Appleshare Passwords\n \nGiven the keychain unlock password, a master key obtained using [volafox](https://github.com/n0fate/volafox) or \n[volatility](https://github.com/volatilityfoundation/volatility), or an unlock file such as SystemKey, Chainbreaker will\nalso provide plaintext passwords.\n\nWithout one of these methods of unlocking the Keychain, Chainbreaker will display all other available information.\n## Install and run\nYou can either just run the code from source, or import it as a module and run as a module.\nTo run the code from source, just clone/download the sourcecode, make sure you have installed the dependencies and run ``chainbreaker.py`` as a script.\n\n### Build the module\n1) Navigate to the directory containing the file `setup.py`\n2) Enter the command (from terminal): `$ python setup.py bdist_wheel -d dist`.\nThis creates a wheel file (extension: `.whl`) in the `/dist` folder.\n3) Install the wheelfile with pip, or (if in the same directory containing `setup.py`) run: `$ pip install -e .`\n\n### Running chainbreaker as a module\nAfter succesfully installing the wheelfile, you can use the module from the command-line (allowing you to use input arguments) as follows:\n\n```$ python -m chainbreaker```\n\nOr you can import it nicely within other scripts like so:\n\n```python\nimport chainbreaker \nkeychain = chainbreaker.Chainbreaker('path/to/keychain/file/login.keychain', unlock_password='SecretPasswordHere')\n```\n\nAnd this returns a keychain object which you can use in your script.\n\n\n\n## Supported OS's\nOS X Snow Leopard(10.6) to macOS Ventura(13) \n\n## Target Keychain file\nAny valid .keychain or .keychain-db can be supplied. Common Keychain locations include: \n* User keychains, these can contain ID's, passwords, and other secure data pertaining to installed applications, ssh/vpn, mail, contacts, calendar\n    * /Users/[username]/Library/Keychains/login.keychain\n    * /Users/[username]/Library/Keychains/login.keychain-db\n\n* System Keychains, these can contain WiFi passwords registered by the local machine and several certifications and public/private keys.\n    * /Library/Keychains/System.keychain\n        * Note: The unlock file for this keychain is commonly located at /var/db/SystemKey\n\n## Help:\n```\n$ python -m chainbreaker --help\nusage: chainbreaker.py [-h] [--dump-all] [--dump-keychain-password-hash]\n                       [--dump-generic-passwords] [--dump-internet-passwords]\n                       [--dump-appleshare-passwords] [--dump-private-keys]\n                       [--dump-public-keys] [--dump-x509-certificates]\n                       [--export-keychain-password-hash]\n                       [--export-generic-passwords]\n                       [--export-internet-passwords]\n                       [--export-appleshare-passwords] [--export-private-keys]\n                       [--export-public-keys] [--export-x509-certificates]\n                       [--export-all] [--check-unlock-options]\n                       [--password-prompt] [--password PASSWORD]\n                       [--key-prompt] [--key KEY] [--unlock-file UNLOCK_FILE]\n                       [--output OUTPUT] [-d]\n                       keychain\n\nDump items stored in an OSX Keychain\n\npositional arguments:\n  keychain              Location of the keychain file to parse\n\noptional arguments:\n  -h, --help            show this help message and exit\n\nDump Actions:\n  --dump-all, -a        Dump records to the console window.\n  --dump-keychain-password-hash\n                        Dump the keychain password hash in a format suitable\n                        for hashcat or John The Ripper\n  --dump-generic-passwords\n                        Dump all generic passwords\n  --dump-internet-passwords\n                        Dump all internet passwords\n  --dump-appleshare-passwords\n                        Dump all appleshare passwords\n  --dump-private-keys   Dump all private keys\n  --dump-public-keys    Dump all public keys\n  --dump-x509-certificates\n                        Dump all X509 certificates\n\nExport Actions:\n  Export records to files. Save location is CWD, but can be overridden with\n  --output / -o\n\n  --export-keychain-password-hash\n                        Save the keychain password hash to disk\n  --export-generic-passwords\n                        Save all generic passwords to disk\n  --export-internet-passwords\n                        Save all internet passwords to disk\n  --export-appleshare-passwords\n                        Save all appleshare passwords to disk\n  --export-private-keys\n                        Save private keys to disk\n  --export-public-keys  Save public keys to disk\n  --export-x509-certificates\n                        Save X509 certificates to disk\n  --export-all, -e      Save records to disk\n\nMisc. Actions:\n  --check-unlock-options, -c\n                        Only check to see if the provided unlock options work.\n                        Exits 0 on success, 1 on failure.\n\nUnlock Options:\n  --password-prompt, -p\n                        Prompt for a password to use in unlocking the keychain\n  --password PASSWORD   Unlock the keychain with a password, provided on the\n                        terminal.Caution: This is insecure and you should\n                        likely use--password-prompt instead\n  --key-prompt, -k      Prompt for a key to use in unlocking the keychain\n  --key KEY             Unlock the keychain with a key, provided via\n                        argument.Caution: This is insecure and you should\n                        likely use --key-prompt instead\n  --unlock-file UNLOCK_FILE\n                        Unlock the keychain with a key file\n\nOutput Options:\n  --output OUTPUT, -o OUTPUT\n                        Directory to output exported records to.\n  -d, --debug           Print debug information\n```\n\n\n## Example Usage\n```\npython -m chainbreaker -pa test_keychain.keychain -o output\n2020-11-12 15:58:18,925 - INFO - \n\n2020-11-12 15:58:18,925 - INFO - Keychain: test_keychain.keychain\n2020-11-12 15:58:18,925 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc\n2020-11-12 15:58:18,925 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441\n2020-11-12 15:58:18,925 - INFO - Dump Start: 2020-11-12 15:58:18.925479\n2020-11-12 15:58:19,245 - INFO - 1 Keychain Password Hash\n2020-11-12 15:58:19,245 - INFO - \t$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5\n2020-11-12 15:58:19,245 - INFO - \n2020-11-12 15:58:19,245 - INFO - 2 Generic Passwords\n2020-11-12 15:58:20,306 - INFO - \t[+] Generic Password Record\n2020-11-12 15:58:20,306 - INFO - \t [-] Create DateTime: 2020-10-13 23:01:17\n2020-11-12 15:58:20,306 - INFO - \t [-] Last Modified DateTime: 2020-10-13 23:01:17\n2020-11-12 15:58:20,306 - INFO - \t [-] Description: secure note\n2020-11-12 15:58:20,306 - INFO - \t [-] Creator: \n2020-11-12 15:58:20,306 - INFO - \t [-] Type: note\n2020-11-12 15:58:20,307 - INFO - \t [-] Print Name: Test Secure Note\n2020-11-12 15:58:20,307 - INFO - \t [-] Alias: \n2020-11-12 15:58:20,307 - INFO - \t [-] Account: \n2020-11-12 15:58:20,307 - INFO - \t [-] Service: Test Secure Note\n2020-11-12 15:58:20,307 - INFO - \t [-] Base64 Encoded Password: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+Tk9URTwva2V5PgoJPHN0cmluZz5UaGlzIGlzIGEgdGVzdCBzZWN1cmUgbm90ZS4gSSBkb27igJl0IGtub3cgdGhhdCBDaGFpbmJyZWFrZXIgd2lsbCBiZSBhYmxlIHRvIHNlZSBpdOKApjwvc3RyaW5nPgoJPGtleT5SVEZEPC9rZXk+Cgk8ZGF0YT4KCWNuUm1aQUFBQUFBREFBQUFBZ0FBQUFjQUFBQlVXRlF1Y25SbUFRQUFBQzdUQVFBQUt3QUFBQUVBQUFETEFRQUFlMXh5CglkR1l4WEdGdWMybGNZVzV6YVdOd1p6RXlOVEpjWTI5amIyRnlkR1l5TlRFekNseGpiMk52WVhSbGVIUnpZMkZzYVc1bgoJTUZ4amIyTnZZWEJzWVhSbWIzSnRNSHRjWm05dWRIUmliRnhtTUZ4bWJtbHNYR1pqYUdGeWMyVjBNQ0JJWld4MlpYUnAKCVkyRk9aWFZsTFV4cFoyaDBPMzBLZTF4amIyeHZjblJpYkR0Y2NtVmtNalUxWEdkeVpXVnVNalUxWEdKc2RXVXlOVFU3CglYSEpsWkRCY1ozSmxaVzR3WEdKc2RXVXdPMzBLZTF3cVhHVjRjR0Z1WkdWa1kyOXNiM0owWW13N08xeGpjM055WjJKYwoJWXpCY1l6QmNZekJjWTI1aGJXVWdkR1Y0ZEVOdmJHOXlPMzBLWEhCaGNtUmNkSGcxTmpCY2RIZ3hNVEl3WEhSNE1UWTQKCU1GeDBlREl5TkRCY2RIZ3lPREF3WEhSNE16TTJNRngwZURNNU1qQmNkSGcwTkRnd1hIUjROVEEwTUZ4MGVEVTJNREJjCglkSGcyTVRZd1hIUjROamN5TUZ4d1lYSmthWEp1WVhSMWNtRnNYSEJoY25ScFoyaDBaVzVtWVdOMGIzSXdDZ3BjWmpCYwoJWm5NeU5pQmNZMll5SUZSb2FYTWdhWE1nWVNCMFpYTjBJSE5sWTNWeVpTQnViM1JsTGlCSklHUnZibHduT1RKMElHdHUKCWIzY2dkR2hoZENCRGFHRnBibUp5WldGclpYSWdkMmxzYkNCaVpTQmhZbXhsSUhSdklITmxaU0JwZEZ3bk9EVjlBUUFBCglBQ01BQUFBQkFBQUFCd0FBQUZSWVZDNXlkR1lRQUFBQXZUR0dYN1lCQUFBQUFBQUFBQUFBQUE9PQoJPC9kYXRhPgo8L2RpY3Q+CjwvcGxpc3Q+Cg==\n2020-11-12 15:58:20,307 - INFO - \t\n2020-11-12 15:58:20,307 - INFO - \n2020-11-12 15:58:20,331 - INFO - \t[+] Generic Password Record\n2020-11-12 15:58:20,331 - INFO - \t [-] Create DateTime: 2020-09-24 23:34:14\n2020-11-12 15:58:20,331 - INFO - \t [-] Last Modified DateTime: 2020-09-29 21:54:55\n2020-11-12 15:58:20,331 - INFO - \t [-] Description: \n2020-11-12 15:58:20,332 - INFO - \t [-] Creator: \n2020-11-12 15:58:20,332 - INFO - \t [-] Type: \n2020-11-12 15:58:20,332 - INFO - \t [-] Print Name: Stored Test Password\n2020-11-12 15:58:20,332 - INFO - \t [-] Alias: \n2020-11-12 15:58:20,332 - INFO - \t [-] Account: TestUser\n2020-11-12 15:58:20,332 - INFO - \t [-] Service: Stored Test Password\n2020-11-12 15:58:20,332 - INFO - \t [-] Password: TestPasswordValue123!\n2020-11-12 15:58:20,332 - INFO - \t\n2020-11-12 15:58:20,332 - INFO - \n2020-11-12 15:58:20,332 - INFO - 1 Internet Passwords\n2020-11-12 15:58:20,356 - INFO - \t[+] Internet Record\n2020-11-12 15:58:20,356 - INFO - \t [-] Create DateTime: 2020-09-29 22:21:51\n2020-11-12 15:58:20,356 - INFO - \t [-] Last Modified DateTime: 2020-09-29 22:21:51\n2020-11-12 15:58:20,356 - INFO - \t [-] Description: \n2020-11-12 15:58:20,356 - INFO - \t [-] Comment: \n2020-11-12 15:58:20,356 - INFO - \t [-] Creator: \n2020-11-12 15:58:20,356 - INFO - \t [-] Type: \n2020-11-12 15:58:20,356 - INFO - \t [-] PrintName: example.com\n2020-11-12 15:58:20,356 - INFO - \t [-] Alias: \n2020-11-12 15:58:20,357 - INFO - \t [-] Protected: \n2020-11-12 15:58:20,357 - INFO - \t [-] Account: TestUsername\n2020-11-12 15:58:20,357 - INFO - \t [-] SecurityDomain: \n2020-11-12 15:58:20,357 - INFO - \t [-] Server: example.com\n2020-11-12 15:58:20,357 - INFO - \t [-] Protocol Type: kSecProtocolTypeHTTPS\n2020-11-12 15:58:20,357 - INFO - \t [-] Auth Type: kSecAuthenticationTypeDefault\n2020-11-12 15:58:20,357 - INFO - \t [-] Port: 0\n2020-11-12 15:58:20,357 - INFO - \t [-] Path: \n2020-11-12 15:58:20,357 - INFO - \t [-] Password: TestPassword123!\n2020-11-12 15:58:20,357 - INFO - \t\n2020-11-12 15:58:20,357 - INFO - \n2020-11-12 15:58:20,357 - INFO - 0 Appleshare Passwords\n2020-11-12 15:58:20,357 - INFO - 0 Private Keys\n2020-11-12 15:58:20,357 - INFO - 0 Public Keys\n2020-11-12 15:58:20,357 - INFO - 1 x509 Certificates\n2020-11-12 15:58:20,357 - INFO - \t[+] X509 Certificate\n2020-11-12 15:58:20,357 - INFO - \t [-] Print Name: Apple Root CA\n2020-11-12 15:58:20,358 - INFO - \t [-] Certificate: MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmELes2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRrEdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6wsIG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCSC7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CWQYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMUZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggrBgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvMIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9saWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVudHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J20ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNiiPvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh\n2020-11-12 15:58:20,358 - INFO - \t\n2020-11-12 15:58:20,358 - INFO - \n2020-11-12 15:58:20,358 - INFO - \n\nChainBreaker 2 - https://github.com/gaddie-3/chainbreaker\n\n2020-11-12 15:58:20,358 - INFO - Runtime Command: chainbreaker.py --password=TestPassword -a test_keychain.keychain\n2020-11-12 15:58:20,358 - INFO - Keychain: test_keychain.keychain\n2020-11-12 15:58:20,358 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc\n2020-11-12 15:58:20,358 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441\n2020-11-12 15:58:20,358 - INFO - Dump Start: 2020-11-12 15:58:18.925479\n2020-11-12 15:58:20,358 - INFO - Dump Summary:\n2020-11-12 15:58:20,358 - INFO - \t1 Keychain Password Hash\n2020-11-12 15:58:20,358 - INFO - \t2 Generic Passwords\n2020-11-12 15:58:20,358 - INFO - \t1 Internet Passwords\n2020-11-12 15:58:20,358 - INFO - \t0 Appleshare Passwords\n2020-11-12 15:58:20,358 - INFO - \t0 Private Keys\n2020-11-12 15:58:20,359 - INFO - \t0 Public Keys\n2020-11-12 15:58:20,359 - INFO - \t1 x509 Certificates\n2020-11-12 15:58:20,359 - INFO - Dump End: 2020-11-12 15:58:20.358259\n```\n\n## Cracking the Keychain Hash using hashcat\n### Hash Extraction\nThe password used to encrypt a keychain can be dumped using the --dump-keychain-password-hash option.\n```\n$ ./chainbreaker.py --dump-keychain-password-hash ./test_keychain.keychain \nKeychain Password Hash\n\t$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5\n```\n### Hash Cracking\nAfter obtaining the keychain password hash, you can use a program such as [hashcat](https://hashcat.net/hashcat/) to attempt to crack it.\n\n```\n\n\u003e hashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt\nhashcat (v6.1.1) starting...\n\n[...]\n\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 256\n\nHashes: 1 digests; 1 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates\nRules: 1\n\nApplicable optimizers applied:\n* Zero-Byte\n* Single-Hash\n* Single-Salt\n* Slow-Hash-SIMD-LOOP\n\n[...]\n\n$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5:TestPassword\n\nSession..........: hashcat\nStatus...........: Cracked\nHash.Name........: Apple Keychain\nHash.Target......: $keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1...d067e5\n[...]\n\n```\n\n*Note:* As described in [hashcat #2457](https://github.com/hashcat/hashcat/issues/2457) collisions are very common based on the current checks.\nTo combat this, you'll want to use the \"--keep-guessing\" flag, and keep trying the found passwords until you (hopefully) get the correct one.\n\n## Extraction from memory images\nVolofax can be used to extract Keychain files and master key candidates from memory images.\n\n\n```\n$ python vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump\n\n[+] Find MALLOC_TINY heap range (guess)\n [-] range 0x7fef03400000-0x7fef03500000\n [...]\n [-] range 0x7fef04900000-0x7fef04a00000\n\n[*] Search for keys in range 0x7fef03400000-0x7fef03500000 complete. master key candidates : 0\n[...]\n[*] Search for keys in range 0x7fef04900000-0x7fef04a00000 complete. master key candidates : 6\n\n[*] master key candidate: 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9\n[...]\n[*] master key candidate: 903C49F0FE0700C0133749F0FE0700404158544D00000000\n \n$ ./chainbreaker.py --key 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9 ./test_keychain.keychain\n```\n\nAdditional examples can be found in this [gist](https://gist.github.com/n0fate/790428d408d54b910956) by n0fate.\n\n## Why the rewrite?\nChainbreaker2 was forked to be heavily refactored and modified from the original [chainbreaker](https://github.com/n0fate/chainbreaker).\n \nThe primary reason behind this fork is to add better support integration into third-party forensic platforms such as \n[Autopsy](https://www.autopsy.com/).  \n\nDuring the refactor, additional functionality was added including: \n* Enhanced user control and options \n* Extraction of the Keychain hash for use with third-party hash cracking software.\n* Dumping all available information, regardless of the presence of an unlocking method\n\n\n## Credits\n* Chainbreaker2 has been significantly refactored and with accitional functionality added by [Luke Gaddie](luke@socially-inept.net)\n* The original author of [chainbreaker](https://github.com/n0fate/chainbreaker) is [n0fate](http://twitter.com/n0fate) \n\n## License\n[GNU GPL v2](http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)\n\n## TODO\n* Better commenting of code.\n* Better documentation of the keychain format.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn0fate%2Fchainbreaker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fn0fate%2Fchainbreaker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn0fate%2Fchainbreaker/lists"}