n0fate / chainbreaker

Mac OS X Keychain Forensic Tool

Chainbreaker

Chainbreaker can be used to extract the following types of information from an OSX keychain in a forensically sound manner:

• Hashed Keychain password, suitable for cracking with hashcat or John the Ripper
• Internet Passwords
• Generic Passwords
• Private Keys
• Public Keys
• X509 Certificates
• Secure Notes
• Appleshare Passwords

Given the keychain unlock password, a master key obtained using volafox or volatility, or an unlock file such as SystemKey, Chainbreaker will also provide plaintext passwords.

Without one of these methods of unlocking the Keychain, Chainbreaker will display all other available information.

Install and run

You can either just run the code from source, or import it as a module and run as a module. To run the code from source, just clone/download the sourcecode, make sure you have installed the dependencies and run chainbreaker.py as a script.

Build the module

1. Navigate to the directory containing the file setup.py
2. Enter the command (from terminal): $ python setup.py bdist_wheel -d dist. This creates a wheel file (extension: .whl) in the /dist folder.
3. Install the wheelfile with pip, or (if in the same directory containing setup.py) run: $ pip install -e .

Running chainbreaker as a module

After succesfully installing the wheelfile, you can use the module from the command-line (allowing you to use input arguments) as follows:

$ python -m chainbreaker

Or you can import it nicely within other scripts like so:

import chainbreaker 
keychain = chainbreaker.Chainbreaker('path/to/keychain/file/login.keychain', unlock_password='SecretPasswordHere')

And this returns a keychain object which you can use in your script.

Supported OS's

OS X Snow Leopard(10.6) to macOS Ventura(13)

Target Keychain file

Any valid .keychain or .keychain-db can be supplied. Common Keychain locations include:

• User keychains, these can contain ID's, passwords, and other secure data pertaining to installed applications, ssh/vpn, mail, contacts, calendar

  • /Users/[username]/Library/Keychains/login.keychain
  • /Users/[username]/Library/Keychains/login.keychain-db

• System Keychains, these can contain WiFi passwords registered by the local machine and several certifications and public/private keys.

  • /Library/Keychains/System.keychain
    • Note: The unlock file for this keychain is commonly located at /var/db/SystemKey

Help:

$ python -m chainbreaker --help
usage: chainbreaker.py [-h] [--dump-all] [--dump-keychain-password-hash]
                       [--dump-generic-passwords] [--dump-internet-passwords]
                       [--dump-appleshare-passwords] [--dump-private-keys]
                       [--dump-public-keys] [--dump-x509-certificates]
                       [--export-keychain-password-hash]
                       [--export-generic-passwords]
                       [--export-internet-passwords]
                       [--export-appleshare-passwords] [--export-private-keys]
                       [--export-public-keys] [--export-x509-certificates]
                       [--export-all] [--check-unlock-options]
                       [--password-prompt] [--password PASSWORD]
                       [--key-prompt] [--key KEY] [--unlock-file UNLOCK_FILE]
                       [--output OUTPUT] [-d]
                       keychain

Dump items stored in an OSX Keychain

positional arguments:
  keychain              Location of the keychain file to parse

optional arguments:
  -h, --help            show this help message and exit

Dump Actions:
  --dump-all, -a        Dump records to the console window.
  --dump-keychain-password-hash
                        Dump the keychain password hash in a format suitable
                        for hashcat or John The Ripper
  --dump-generic-passwords
                        Dump all generic passwords
  --dump-internet-passwords
                        Dump all internet passwords
  --dump-appleshare-passwords
                        Dump all appleshare passwords
  --dump-private-keys   Dump all private keys
  --dump-public-keys    Dump all public keys
  --dump-x509-certificates
                        Dump all X509 certificates

Export Actions:
  Export records to files. Save location is CWD, but can be overridden with
  --output / -o

  --export-keychain-password-hash
                        Save the keychain password hash to disk
  --export-generic-passwords
                        Save all generic passwords to disk
  --export-internet-passwords
                        Save all internet passwords to disk
  --export-appleshare-passwords
                        Save all appleshare passwords to disk
  --export-private-keys
                        Save private keys to disk
  --export-public-keys  Save public keys to disk
  --export-x509-certificates
                        Save X509 certificates to disk
  --export-all, -e      Save records to disk

Misc. Actions:
  --check-unlock-options, -c
                        Only check to see if the provided unlock options work.
                        Exits 0 on success, 1 on failure.

Unlock Options:
  --password-prompt, -p
                        Prompt for a password to use in unlocking the keychain
  --password PASSWORD   Unlock the keychain with a password, provided on the
                        terminal.Caution: This is insecure and you should
                        likely use--password-prompt instead
  --key-prompt, -k      Prompt for a key to use in unlocking the keychain
  --key KEY             Unlock the keychain with a key, provided via
                        argument.Caution: This is insecure and you should
                        likely use --key-prompt instead
  --unlock-file UNLOCK_FILE
                        Unlock the keychain with a key file

Output Options:
  --output OUTPUT, -o OUTPUT
                        Directory to output exported records to.
  -d, --debug           Print debug information

Example Usage

python -m chainbreaker -pa test_keychain.keychain -o output
2020-11-12 15:58:18,925 - INFO - 

2020-11-12 15:58:18,925 - INFO - Keychain: test_keychain.keychain
2020-11-12 15:58:18,925 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc
2020-11-12 15:58:18,925 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441
2020-11-12 15:58:18,925 - INFO - Dump Start: 2020-11-12 15:58:18.925479
2020-11-12 15:58:19,245 - INFO - 1 Keychain Password Hash
2020-11-12 15:58:19,245 - INFO - 	$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5
2020-11-12 15:58:19,245 - INFO - 
2020-11-12 15:58:19,245 - INFO - 2 Generic Passwords
2020-11-12 15:58:20,306 - INFO - 	[+] Generic Password Record
2020-11-12 15:58:20,306 - INFO - 	 [-] Create DateTime: 2020-10-13 23:01:17
2020-11-12 15:58:20,306 - INFO - 	 [-] Last Modified DateTime: 2020-10-13 23:01:17
2020-11-12 15:58:20,306 - INFO - 	 [-] Description: secure note
2020-11-12 15:58:20,306 - INFO - 	 [-] Creator: 
2020-11-12 15:58:20,306 - INFO - 	 [-] Type: note
2020-11-12 15:58:20,307 - INFO - 	 [-] Print Name: Test Secure Note
2020-11-12 15:58:20,307 - INFO - 	 [-] Alias: 
2020-11-12 15:58:20,307 - INFO - 	 [-] Account: 
2020-11-12 15:58:20,307 - INFO - 	 [-] Service: Test Secure Note
2020-11-12 15:58:20,307 - INFO - 	 [-] Base64 Encoded Password: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+Tk9URTwva2V5PgoJPHN0cmluZz5UaGlzIGlzIGEgdGVzdCBzZWN1cmUgbm90ZS4gSSBkb27igJl0IGtub3cgdGhhdCBDaGFpbmJyZWFrZXIgd2lsbCBiZSBhYmxlIHRvIHNlZSBpdOKApjwvc3RyaW5nPgoJPGtleT5SVEZEPC9rZXk+Cgk8ZGF0YT4KCWNuUm1aQUFBQUFBREFBQUFBZ0FBQUFjQUFBQlVXRlF1Y25SbUFRQUFBQzdUQVFBQUt3QUFBQUVBQUFETEFRQUFlMXh5CglkR1l4WEdGdWMybGNZVzV6YVdOd1p6RXlOVEpjWTI5amIyRnlkR1l5TlRFekNseGpiMk52WVhSbGVIUnpZMkZzYVc1bgoJTUZ4amIyTnZZWEJzWVhSbWIzSnRNSHRjWm05dWRIUmliRnhtTUZ4bWJtbHNYR1pqYUdGeWMyVjBNQ0JJWld4MlpYUnAKCVkyRk9aWFZsTFV4cFoyaDBPMzBLZTF4amIyeHZjblJpYkR0Y2NtVmtNalUxWEdkeVpXVnVNalUxWEdKc2RXVXlOVFU3CglYSEpsWkRCY1ozSmxaVzR3WEdKc2RXVXdPMzBLZTF3cVhHVjRjR0Z1WkdWa1kyOXNiM0owWW13N08xeGpjM055WjJKYwoJWXpCY1l6QmNZekJjWTI1aGJXVWdkR1Y0ZEVOdmJHOXlPMzBLWEhCaGNtUmNkSGcxTmpCY2RIZ3hNVEl3WEhSNE1UWTQKCU1GeDBlREl5TkRCY2RIZ3lPREF3WEhSNE16TTJNRngwZURNNU1qQmNkSGcwTkRnd1hIUjROVEEwTUZ4MGVEVTJNREJjCglkSGcyTVRZd1hIUjROamN5TUZ4d1lYSmthWEp1WVhSMWNtRnNYSEJoY25ScFoyaDBaVzVtWVdOMGIzSXdDZ3BjWmpCYwoJWm5NeU5pQmNZMll5SUZSb2FYTWdhWE1nWVNCMFpYTjBJSE5sWTNWeVpTQnViM1JsTGlCSklHUnZibHduT1RKMElHdHUKCWIzY2dkR2hoZENCRGFHRnBibUp5WldGclpYSWdkMmxzYkNCaVpTQmhZbXhsSUhSdklITmxaU0JwZEZ3bk9EVjlBUUFBCglBQ01BQUFBQkFBQUFCd0FBQUZSWVZDNXlkR1lRQUFBQXZUR0dYN1lCQUFBQUFBQUFBQUFBQUE9PQoJPC9kYXRhPgo8L2RpY3Q+CjwvcGxpc3Q+Cg==
2020-11-12 15:58:20,307 - INFO - 	
2020-11-12 15:58:20,307 - INFO - 
2020-11-12 15:58:20,331 - INFO - 	[+] Generic Password Record
2020-11-12 15:58:20,331 - INFO - 	 [-] Create DateTime: 2020-09-24 23:34:14
2020-11-12 15:58:20,331 - INFO - 	 [-] Last Modified DateTime: 2020-09-29 21:54:55
2020-11-12 15:58:20,331 - INFO - 	 [-] Description: 
2020-11-12 15:58:20,332 - INFO - 	 [-] Creator: 
2020-11-12 15:58:20,332 - INFO - 	 [-] Type: 
2020-11-12 15:58:20,332 - INFO - 	 [-] Print Name: Stored Test Password
2020-11-12 15:58:20,332 - INFO - 	 [-] Alias: 
2020-11-12 15:58:20,332 - INFO - 	 [-] Account: TestUser
2020-11-12 15:58:20,332 - INFO - 	 [-] Service: Stored Test Password
2020-11-12 15:58:20,332 - INFO - 	 [-] Password: TestPasswordValue123!
2020-11-12 15:58:20,332 - INFO - 	
2020-11-12 15:58:20,332 - INFO - 
2020-11-12 15:58:20,332 - INFO - 1 Internet Passwords
2020-11-12 15:58:20,356 - INFO - 	[+] Internet Record
2020-11-12 15:58:20,356 - INFO - 	 [-] Create DateTime: 2020-09-29 22:21:51
2020-11-12 15:58:20,356 - INFO - 	 [-] Last Modified DateTime: 2020-09-29 22:21:51
2020-11-12 15:58:20,356 - INFO - 	 [-] Description: 
2020-11-12 15:58:20,356 - INFO - 	 [-] Comment: 
2020-11-12 15:58:20,356 - INFO - 	 [-] Creator: 
2020-11-12 15:58:20,356 - INFO - 	 [-] Type: 
2020-11-12 15:58:20,356 - INFO - 	 [-] PrintName: example.com
2020-11-12 15:58:20,356 - INFO - 	 [-] Alias: 
2020-11-12 15:58:20,357 - INFO - 	 [-] Protected: 
2020-11-12 15:58:20,357 - INFO - 	 [-] Account: TestUsername
2020-11-12 15:58:20,357 - INFO - 	 [-] SecurityDomain: 
2020-11-12 15:58:20,357 - INFO - 	 [-] Server: example.com
2020-11-12 15:58:20,357 - INFO - 	 [-] Protocol Type: kSecProtocolTypeHTTPS
2020-11-12 15:58:20,357 - INFO - 	 [-] Auth Type: kSecAuthenticationTypeDefault
2020-11-12 15:58:20,357 - INFO - 	 [-] Port: 0
2020-11-12 15:58:20,357 - INFO - 	 [-] Path: 
2020-11-12 15:58:20,357 - INFO - 	 [-] Password: TestPassword123!
2020-11-12 15:58:20,357 - INFO - 	
2020-11-12 15:58:20,357 - INFO - 
2020-11-12 15:58:20,357 - INFO - 0 Appleshare Passwords
2020-11-12 15:58:20,357 - INFO - 0 Private Keys
2020-11-12 15:58:20,357 - INFO - 0 Public Keys
2020-11-12 15:58:20,357 - INFO - 1 x509 Certificates
2020-11-12 15:58:20,357 - INFO - 	[+] X509 Certificate
2020-11-12 15:58:20,357 - INFO - 	 [-] Print Name: Apple Root CA
2020-11-12 15:58:20,358 - INFO - 	 [-] Certificate: MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmELes2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRrEdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6wsIG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCSC7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CWQYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMUZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggrBgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvMIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9saWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVudHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J20ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNiiPvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh
2020-11-12 15:58:20,358 - INFO - 	
2020-11-12 15:58:20,358 - INFO - 
2020-11-12 15:58:20,358 - INFO - 

ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker

2020-11-12 15:58:20,358 - INFO - Runtime Command: chainbreaker.py --password=TestPassword -a test_keychain.keychain
2020-11-12 15:58:20,358 - INFO - Keychain: test_keychain.keychain
2020-11-12 15:58:20,358 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc
2020-11-12 15:58:20,358 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441
2020-11-12 15:58:20,358 - INFO - Dump Start: 2020-11-12 15:58:18.925479
2020-11-12 15:58:20,358 - INFO - Dump Summary:
2020-11-12 15:58:20,358 - INFO - 	1 Keychain Password Hash
2020-11-12 15:58:20,358 - INFO - 	2 Generic Passwords
2020-11-12 15:58:20,358 - INFO - 	1 Internet Passwords
2020-11-12 15:58:20,358 - INFO - 	0 Appleshare Passwords
2020-11-12 15:58:20,358 - INFO - 	0 Private Keys
2020-11-12 15:58:20,359 - INFO - 	0 Public Keys
2020-11-12 15:58:20,359 - INFO - 	1 x509 Certificates
2020-11-12 15:58:20,359 - INFO - Dump End: 2020-11-12 15:58:20.358259

Cracking the Keychain Hash using hashcat

Hash Extraction

The password used to encrypt a keychain can be dumped using the --dump-keychain-password-hash option.

$ ./chainbreaker.py --dump-keychain-password-hash ./test_keychain.keychain 
Keychain Password Hash
	$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5

Hash Cracking

After obtaining the keychain password hash, you can use a program such as hashcat to attempt to crack it.

> hashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt
hashcat (v6.1.1) starting...

[...]

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

[...]

$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5:TestPassword

Session..........: hashcat
Status...........: Cracked
Hash.Name........: Apple Keychain
Hash.Target......: $keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1...d067e5
[...]

Note: As described in hashcat #2457 collisions are very common based on the current checks. To combat this, you'll want to use the "--keep-guessing" flag, and keep trying the found passwords until you (hopefully) get the correct one.

Extraction from memory images

Volofax can be used to extract Keychain files and master key candidates from memory images.

$ python vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump

[+] Find MALLOC_TINY heap range (guess)
 [-] range 0x7fef03400000-0x7fef03500000
 [...]
 [-] range 0x7fef04900000-0x7fef04a00000

[*] Search for keys in range 0x7fef03400000-0x7fef03500000 complete. master key candidates : 0
[...]
[*] Search for keys in range 0x7fef04900000-0x7fef04a00000 complete. master key candidates : 6

[*] master key candidate: 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9
[...]
[*] master key candidate: 903C49F0FE0700C0133749F0FE0700404158544D00000000
 
$ ./chainbreaker.py --key 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9 ./test_keychain.keychain

Additional examples can be found in this gist by n0fate.

Why the rewrite?

Chainbreaker2 was forked to be heavily refactored and modified from the original chainbreaker.

The primary reason behind this fork is to add better support integration into third-party forensic platforms such as Autopsy.

During the refactor, additional functionality was added including:

• Enhanced user control and options
• Extraction of the Keychain hash for use with third-party hash cracking software.
• Dumping all available information, regardless of the presence of an unlocking method

Credits

• Chainbreaker2 has been significantly refactored and with accitional functionality added by Luke Gaddie
• The original author of chainbreaker is n0fate

License

GNU GPL v2

TODO

• Better commenting of code.
• Better documentation of the keychain format.

chainbreaker's Issues

This doesn't appear to support "Local items"

Invalid triple DES key size. Key must be either 16 or 24 bytes long

MBP:chainbreaker-master kevin$ python chainbreaker.py -f /Library/Keychains/System.keychain -k 2fc651f52eca28b3bd66890c35528e95fa802e52fa4d6079
[-] DB Key
00000000: 00 .
[+] Symmetric Key Table: 0x00007968
Traceback (most recent call last):
File "chainbreaker.py", line 970, in
main()
File "chainbreaker.py", line 781, in main
passwd = keychain.KeyblobDecryption(ciphertext, iv, dbkey)
File "chainbreaker.py", line 599, in KeyblobDecryption
plain = kcdecrypt(dbkey, magicCmsIV, encryptedblob)
File "chainbreaker.py", line 696, in kcdecrypt
cipher = triple_des(key, CBC, iv)
File "/Users/kevin/Downloads/chainbreaker-master/pyDes.py", line 524, in init
self.setKey(key)
File "/Users/kevin/Downloads/chainbreaker-master/pyDes.py", line 537, in setKey
raise ValueError("Invalid triple DES key size. Key must be either 16 or 24 bytes long")
ValueError: Invalid triple DES key size. Key must be either 16 or 24 bytes long

Missing parentheses

Had a play with this today and it did a good job of pulling out data from a System.keychain file. I needed to add parentheses to all of the 'print' lines first, though.
chainbreaker.zip

Dump passkeys

Hi.

Is there any way to dump passkeys?
According to About the security of passkeys they're supposed to be somewhere in the iCloud Keychain, but I haven't found anything similar to passkey by issuing the:

python -m chainbreaker --dump-public-keys ~/Library/Keychains/login.keychain-db

If you want to reproduce and create sample passkey, I would recommend YubiKey's demo site.
Note: need to use Safari on macOS to create syncable passkey.

Local

One question. Where are the Local Items' passwords stored is macOS? I assumed they are stored in the Keychain since the passwords are available when I open the Keychain app. Chainbreaker will pull the login items, but not the Local Items, which contains the passwords to websites stored in the Internet Browsers. I need to pull that information as well. See photo below. Thank you!

macOS 11 Big Sur Private Key Table is not available

python2.7 chainbreaker.py -p --dump-private-keys "/Users/xxx/Library/Keychains/login.keychain-db"

...
WARING - [!] Private Key Table is not available
INFO - 0 Private Keys
...

Is this a Big Sur issue?

What am i doing wrong??

im on kali linux

chain break wont grabbing Web form password

how can i get Web form password?

_APPL_DB_HEADER invalid offset for header?

Hey! I'm trying to use this to dump my own internet passwords, I'm running into a crash while parsing the _APPL_DB_HEADER. here's my invocation, and the output:

./chainbreaker.py --dump-internet-passwords --password=<somepassword> -a ~/Library/Keychains/53955E52-7540-58CB-93DD-008F838B7EAD/keychain-2.db
2021-06-24 08:36:09,080 - INFO - 

ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker

2021-06-24 08:36:09,081 - INFO - Runtime Command: ./chainbreaker.py --dump-internet-passwords --password=<somepassword> -a /Users/asb/Library/Keychains/53955E52-7540-58CB-93DD-008F838B7EAD/keychain-2.db
2021-06-24 08:36:09,081 - INFO - Keychain: /Users/asb/Library/Keychains/53955E52-7540-58CB-93DD-008F838B7EAD/keychain-2.db
2021-06-24 08:36:09,081 - INFO - Keychain MD5: 56c8eaa212f0f26f5b4616d2b96ff739
2021-06-24 08:36:09,081 - INFO - Keychain 256: f2824d498f1eaa89385a03c11f14bb4bd5c1a923fdb39d7eac6ed916588437a0
2021-06-24 08:36:09,081 - INFO - Dump Start: 2021-06-24 08:36:09.080976
Traceback (most recent call last):
  File "./chainbreaker.py", line 1277, in <module>
    unlock_file=args.unlock_file)
  File "./chainbreaker.py", line 71, in __init__
    self.filepath = filepath
  File "./chainbreaker.py", line 568, in filepath
    self._read_keychain_to_buffer()
  File "./chainbreaker.py", line 169, in _read_keychain_to_buffer
    self.schema_info, self.table_list = self._get_schema_info(self.header.SchemaOffset)
  File "./chainbreaker.py", line 205, in _get_schema_info
    schema_info = _APPL_DB_SCHEMA(self.kc_buffer[offset:offset + _APPL_DB_SCHEMA.STRUCT.size])
  File "/Users/asb/Developer/chainbreaker/schema.py", line 332, in __init__
    (self.SchemaSize, self.TableCount) = _APPL_DB_SCHEMA.STRUCT.unpack(buffer)
struct.error: unpack requires a string argument of length 8

the offset being used to index into the self.kc_buffer is massive, and it looks like the buffer passed into _APPL_DB_SCHEMA.STRUCT.unpack(buffer) is empty.

I'm running macOS 11.2.3 (20D91), is this something you've run into before? could you help me debug this?

how to access to local items db ?

how?

Question about system and user keychain

@n0fate, I have a question that I cannot understand.

When you open the keychain using the "Keychain Access" applicaton on a Mac, you could unlock all keychains (in my case, I have "Login", "Local Items" and "System") using your system password (of course I assume you do not change the password of the keychain after the creation).

However, using chainbreaker, I could decrypt the user keychain using the password system account, however it does not work when I try to decrypt the system keychain (whereas using the "Keychain Access" application, it works).

At contrary, it's the same problem to decrypt the system keychain, it works using the system key but this key does not work to decrypt the user keychain.

So I cannot understand why "Keychain Access" manage to do it ?

Another thing, does user have user key (such as the system key stored on /private/var/db/SystemKey) and where I can find it? When I see your Readme, you manage with volafox to retrieve multiple master keys from memory:

[*] master key candidate: 78006A6CC504140E077D62D39F30DBBAFC5BDF5995039974
[*] master key candidate: 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9
[*] master key candidate: 2DD97A4ED361F492C01FFF84962307D7B82343B94595726E

And then you decrypt the user keychain using one of these key:

python chainbreaker.py -f ~/Desktop/show/login.keychain -k 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9

So I guess that there are a system key and a user key stored in two different places and both keychains are encrypted using these two different keys.

I tried to understand by myself without success so if you could help to understand this behaviour it would be awesome.

Thanks for your time !

Chainbreaker2 hashing issue

When I try to extract my WiFi passwords I get the follow error, any ideas on how to fix it?

sh-3.2# python3 chainbreaker.py -k -o /Users/me/Downloads/keychain-export/ --export-all /Library/Keychains/System.keychain --unlock-file /private/var/db/SystemKey
Unlock Key:
Traceback (most recent call last):
File "/Users/me/chainbreaker/chainbreaker.py", line 1256, in
keychain_md5 = hashlib.md5(args.keychain).hexdigest()
^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: Strings must be encoded before hashing

I used the hexdump command to gey the key but does not seem to work "hexdump -s 8 -n 24 -e '1/1 "%.2x"' /path/to/SystemKey && echo"

Missing pyopenssl requirement in README

Just to let you know that README-keydump.txt is missing the pyopenssl requirement, should be cool to have a proper requirements.txt though.

Anyway thanks for the tool !

hexdump module not found

Traceback (most recent call last):
File "chainbreaker.py", line 27, in
from hexdump import hexdump
ImportError: No module named hexdump

yes python and pip are installed I tried to figure this out but no luck

How do I export an `non-extractable` certificate

I have a similar problem, https://security.stackexchange.com/questions/64323/export-non-extractable-private-key-from-keychain-on-os-x
The difference is that my device is M1 Pro, macOS 13.1, and I have tried many things with no success, including 'chainbreaker'.
So, I want to ask, do you support the above situation?

ImportError: No module named Crypto.Util

Hello there,
I have an issue attempting to open the login.keychain-db

mbp:chainbreaker admin$ python2 chainbreaker.py -f login.keychain-db -p ********
Traceback (most recent call last):
File "chainbreaker.py", line 35, in <module>
from validator import Validator
File "/Users/admin/chainbreaker/validator.py", line 2, in <module>
from Crypto.Util import asn1
ImportError: No module named Crypto.Util
mbp:chainbreaker admin$

Yes I know the keychain database is to be grabbed from User's library, I just made a local copy of it.
For what it's worth, I am running MacOS 10.15.3 (Catalina)

Any idea how to debug this?
Thanks

Edit: made the output cleaner

Update chainbreaker.py to work with Python 3.x

Python 2 is deprecated and is being removed from macOS in the immediate future starting with version 12.3.

Please update chainbreaker to work under Python 3.x

Chainbreaker2 question

First and foremost, I would like to say a huge thank you for supporting the chain breaker to application I do have a question regarding its execution. I am trying to dump all of my Wi-Fi SSIDs and passwords into a CSV file. It was wondering what the command should look like to do that. I know the system.keychain location, as well as the system key password, thank you again.

Macos Big Sur 11.6.2 [Invalid Password / Keychain Locked]

I'm using this repo https://github.com/nkraetzschmar/chainbreaker.
I can export the private keys from one of my Mac(Big Sur 11.6.1), but it not work with my another Mac(11.6.2).

I run command and got the results.
command:

sudo python2.7 chainbreaker.py --dump-private-keys /Library/Keychains/System.keychain --unlock-file /var/db/SystemKey

2022-02-24 18:00:54,172 - INFO - Dump Start: 2022-02-24 18:00:54.172610
2022-02-24 18:00:54,173 - INFO - 5 Private Keys
2022-02-24 18:00:54,173 - INFO - 	[+] Private Key
2022-02-24 18:00:54,173 - INFO - 	 [-] Print Name: imported private key
2022-02-24 18:00:54,173 - INFO - 	 [-] Key Class: CSSM_KEYCLASS_PRIVATE_KEY
2022-02-24 18:00:54,173 - INFO - 	 [-] Key Type: CSSM_ALGID_RSA
2022-02-24 18:00:54,173 - INFO - 	 [-] Key Size: 2048
2022-02-24 18:00:54,173 - INFO - 	 [-] Effective Key Size: 2048
2022-02-24 18:00:54,173 - INFO - 	 [-] CSSM Type: Core CSP (local space)
2022-02-24 18:00:54,174 - INFO - 	 [-] Base64 Encoded PrivateKey: [Invalid Password / Keychain Locked]
...

When I run this command, I got this result

systemkeychain -vt

Testing system unlock of /Library/Keychains/System.keychain
(If you are prompted for a passphrase, cancel)
System unlock is working

Check out the code and do some simple prints, I found the ciphertext in function _find_wrapping_key is an empty string.
I know nothing at python, I hope someone can help look at this problem, thanks~

Application Bundles Using Chainbreaker Crashing

title, no longer working on Ventura Mac OS

Working if ran from console or unix executable / However when built into Application Bundle Fails with the following issue:

  File "chainbreaker/__init__.py", line 111, in __init__
  File "chainbreaker/__init__.py", line 634, in unlock_password
  File "chainbreaker/__init__.py", line 388, in _generate_master_key
AttributeError: 'NoneType' object has no attribute 'Salt'

cannot import name 'args_control' from partially initialized module

Discussed in #43

^{Originally posted by VladUZH April 23, 2024}
Hi. Getting this error when trying to execute the code. I understand that it is connected to the circular import but don't know how to fix the problem. Any help would be appreciated.

(.conda) (base) vlpetrov@Vladimirs-MacBook-Pro chainbreaker-1 % python -m chainbreaker -pa login.keychain-db -o output
/Users/vlpetrov/Documents/Programming/chainbreaker-1/.conda/bin/python: Error while finding module specification for 'chainbreaker.main' (ImportError: cannot import name 'args_control' from partially initialized module 'chainbreaker' (most likely due to a circular import) (/Users/vlpetrov/Documents/Programming/chainbreaker-1/chainbreaker/init.py))

getAppleshareRecord using the wrong class (struct) to parse

Lines 551 & 553 of chainbreaker.py (getAppleshareRecord function) utilize the '_INTERNET_PW_HEADER' class for parsing the Apple Share records instead of the appropriate '_APPLE_SHARE_HEADER' class.

I noticed that the the _INTERNET_PW_HEADER class has no field 'Volume' and the getAppleshareRecord function attempts to use this in 'RecordMeta.Volume', while the _APPLE_SHARE_HEADER class does in fact have that field. I believe it's probably a simple oversight from copy/pasting but could be wrong...

If you'd like, I can make the small changes and perform a pull request to merge them in. Just let me know!

macOS Monterey Public Key Table is not available

sudo python chainbreaker.py --unlock-file ./SystemKey -a -e /Library/Keychains/System.keychain

...
2022-02-23 17:55:10,160 - INFO - Dump Start: 2022-02-23 17:55:10.159697
private_key_offset2022-02-23 17:55:10,625 - WARNING - 23596
private_key_offset2022-02-23 17:55:10,625 - WARNING - 23596
private_key_offset2022-02-23 17:55:10,625 - WARNING - 23596
private_key_offset2022-02-23 17:55:10,625 - WARNING - 23596
2022-02-23 17:55:10,625 - WARNING - [!] Public Key Table is not available
...

Is Monterey(12.2.1) not support yet?

where can I find the macosxml.mem and mem?

Hi can you help me, I can't find the macosxml.mem and memory image.

Private key export from macOS Monterey system keychain fails with [Invalid Password / Keychain Locked]

Monterey 12.2.1

~/projects/chainbreaker master ./chainbreaker.py -p -o ~/cert/ --export-private-keys /Library/Keychains/System.keychain
Unlock Password:
2022-02-23 14:45:53,858 - INFO -

ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker

2022-02-23 14:45:53,858 - INFO - Runtime Command: ./chainbreaker.py -p -o /Users/XXX/cert/ --export-private-keys /Library/Keychains/System.keychain
2022-02-23 14:45:53,858 - INFO - Keychain: /Library/Keychains/System.keychain
2022-02-23 14:45:53,858 - INFO - Keychain MD5: dcbe47b235cf7fbe6d478b908f2db39e
2022-02-23 14:45:53,858 - INFO - Keychain 256: fb2b63894837680590f21b8ade98340b2a2f283e20324d963fcab49c794bf16d
2022-02-23 14:45:53,858 - INFO - Dump Start: 2022-02-23 14:45:53.858162
- private_key_offset2022-02-23 14:45:53,888 - WARNING - 23632
private_key_offset2022-02-23 14:45:53,888 - WARNING - 23632
private_key_offset2022-02-23 14:45:53,888 - WARNING - 23632
private_key_offset2022-02-23 14:45:53,889 - WARNING - 23632
2022-02-23 14:45:53,889 - INFO - 0 Private Keys
2022-02-23 14:45:53,889 - INFO -

ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker

2022-02-23 14:45:53,889 - INFO - Runtime Command: ./chainbreaker.py -p -o /Users/XXX/cert/ --export-private-keys /Library/Keychains/System.keychain
2022-02-23 14:45:53,889 - INFO - Keychain: /Library/Keychains/System.keychain
2022-02-23 14:45:53,889 - INFO - Keychain MD5: dcbe47b235cf7fbe6d478b908f2db39e
2022-02-23 14:45:53,889 - INFO - Keychain 256: fb2b63894837680590f21b8ade98340b2a2f283e20324d963fcab49c794bf16d
2022-02-23 14:45:53,889 - INFO - Dump Start: 2022-02-23 14:45:53.858162
2022-02-23 14:45:53,889 - INFO - Dump Summary:
2022-02-23 14:45:53,889 - INFO - 	0 Private Keys
2022-02-23 14:45:53,889 - INFO - Dump End: 2022-02-23 14:45:53.889181

So what if I'm a forensic investigator with suspect's drive...

...and I don't have the suspect's password, and the system isn't live (it's just a disk dump)?

Will this tool have any chance of breaking the keychain? Could you give more detail on how?