Formatting/converting hashes into their expected formats
The macOS keychain is encrypted and not readily able to be worked with in its existing format. This means that we need to convert the keychain file so that we can extract the hash and crack it appropriately. John can do this in a standalone utility called keychain2john.py. This utility is installed when you install John with the jumbo patch, as we defined previously.
Once keychain2john.py is installed, we can readily extract the contents needed from the keychain. Let’s go through the keychain2john script and see some of the basics of what’s happening here.
At the time of writing, keychain2john can be found at https://github.com/openwall/john/blob/bleeding-jumbo/run/keychain2john.py. keychain2john performs the following core functions:
- It scans the keychain for the appropriate magic number
- It extracts key items such as the salt, IV, and encryption key
keychain2john requires python3 and takes...
