Skip to content

Latest commit

 

History

History
53 lines (34 loc) · 1.92 KB

README.md

File metadata and controls

53 lines (34 loc) · 1.92 KB
Raw

About

The goal of this project is to make it very easy to convert iTunes backup files to "hashes" which hashcat can crack with mode: -m 14700 or -m 14800

Requirements

Software:

  • Perl must be installed (should work on *nix and windows with perl installed)

Installation and first steps

  • Clone this repository:
    git clone https://github.com/philsmd/itunes_backup2hashcat.git
  • Enter the repository root folder:
    cd itunes_backup2hashcat
  • Run it:
    ./itunes_backup2hashcat.pl Manifest.plist
  • Copy output to a file (or redirect output to a file (>) directly) and run it with hashcat using mode -m 14700 = iTunes Backup < v10.0 or -m 14800 = iTunes Backup v10.x

If the output of itunes_backup2hashcat.pl starts with $itunes_backup$*9* then you need to use hash mode -m 14700, for $itunes_backup$*10* use -m 14800 instead.

Command line parameters

The usage is very simple: you just specify the path to the Manifest.plist file as the first command line argument.

You can also use multiple files on the command line like this:
./itunes_backup2hashcat.pl Manifest.plist Manifest2.plist
./itunes_backup2hashcat.pl *.plist
./itunes_backup2hashcat.pl Manifests/*

Explanation of the hash format

if the backup was generated by IOS version less than 10:
$itunes_backup$*9*wkpy*iter*salt**

version 10.x hashes:
$itunes_backup$*10*wkpy*iter*salt*dpic*dpsl

Hacking / Missing features

  • More features
  • improvements and all bug fixes are very welcome

Credits and Contributors

Credits go to:

  • philsmd, hashcat project

License/Disclaimer

License: belongs to the PUBLIC DOMAIN

Disclaimer: WE PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE Furthermore, NO GUARANTEES THAT IT WORKS FOR YOU AND WORKS CORRECTLY