Now we can simply use the Finder to open the Time Machine. For my use case, I wanted the Time Machine password, and this will be represented in the output as a Generic password record named Time Machine. You'll see the plaintext password of everything in the system keychain. Python chainbreaker.py -f /path/to/system.keychain -k (the byte string from step 1)
Now we simply give chainbreaker the key you just found and the file: Run the following commands on the target machine: You'll need to install the hexdump library for Python. That tool will be Chainbreaker - a python script. We're going on the assumption that the dead Mac can't be booted in such a way that we can use its Keychain Access app normally. Step 2: Dump the keychain using the password This is the decryption key for the keychain. The & echo is so we get a single newline afterward so the output doesn't run into the beginning of your shell prompt after the command finishes.Ĭopy this string aside. Hexdump -s 8 -n 24 -e '1/1 "%.2x"' /path/to/SystemKey & echoĮxplained: Skip the first 8 bytes from the beginning of the file, continue 24 bytes after that, and use the format string to dump the data out on one line (it's a C-style printf string, if you're curious). The proper command to get the right hex key is: Even better, we need 24 bytes out of the middle of the file - after the magic number that indicates a key file, but before the checksum bytes. We can't use SystemKey as is - it contains random bytes that can't be entered into a password dialog or command line. Step 1: Recovering the encryption key for the source keychain The SystemKey file from the source machine.
This file is located in either /System/Library/Keychains or /Library/Keychains.The System.keychain file from the source machine. One new Mac or Linux machine (called the Target machine from here on) One dead Mac with a readable filesystem (called the Source machine from here on).
0 kommentar(er)
