philsmd / itunes_backup2hashcat

Extract the information needed from the Manifest.plist files to convert it to hashes compatible with hashcat

About

The goal of this project is to make it very easy to convert iTunes backup files to "hashes" which hashcat can crack with mode: -m 14700 or -m 14800

Requirements

Software:

• Perl must be installed (should work on *nix and windows with perl installed)

Installation and first steps

• Clone this repository:
  git clone https://github.com/philsmd/itunes_backup2hashcat.git
• Enter the repository root folder:
  cd itunes_backup2hashcat
• Run it:
  ./itunes_backup2hashcat.pl Manifest.plist
• Copy output to a file (or redirect output to a file (>) directly) and run it with hashcat using mode -m 14700 = iTunes Backup < v10.0 or -m 14800 = iTunes Backup v10.x

If the output of itunes_backup2hashcat.pl starts with $itunes_backup$*9* then you need to use hash mode -m 14700, for $itunes_backup$*10* use -m 14800 instead.

Command line parameters

The usage is very simple: you just specify the path to the Manifest.plist file as the first command line argument.

You can also use multiple files on the command line like this:
./itunes_backup2hashcat.pl Manifest.plist Manifest2.plist
./itunes_backup2hashcat.pl *.plist
./itunes_backup2hashcat.pl Manifests/*

Explanation of the hash format

if the backup was generated by IOS version less than 10:
$itunes_backup$*9*wkpy*iter*salt**

version 10.x hashes:
$itunes_backup$*10*wkpy*iter*salt*dpic*dpsl

Hacking / Missing features

• More features
• improvements and all bug fixes are very welcome

Credits and Contributors

Credits go to:

• philsmd, hashcat project

License/Disclaimer

License: belongs to the PUBLIC DOMAIN

Disclaimer: WE PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE Furthermore, NO GUARANTEES THAT IT WORKS FOR YOU AND WORKS CORRECTLY