An updated version of the Chainbreaker2 repository, by making chainbreaker2 compatible for python 3.
Chainbreaker can be used to extract the following types of information from an OSX keychain in a forensically sound manner:
- Hashed Keychain password, suitable for cracking with hashcat or John the Ripper
- Internet Passwords
- Generic Passwords
- Private Keys
- Public Keys
- X509 Certificates
- Secure Notes
- Appleshare Passwords
Given the keychain unlock password, a master key obtained using volafox or volatility, or an unlock file such as SystemKey, Chainbreaker will also provide plaintext passwords.
Without one of these methods of unlocking the Keychain, Chainbreaker will display all other available information.
Snow Leopard, Lion, Mountain Lion, Mavericks, Yosemite, El Capitan, (High) Sierra, Mojave, Catalina
Any valid .keychain or .keychain-db can be supplied. Common Keychain locations include:
-
User keychains, these can contain ID's, passwords, and other secure data pertaining to installed applications, ssh/vpn, mail, contacts, calendar
- /Users/[username]/Library/Keychains/login.keychain
- /Users/[username]/Library/Keychains/login.keychain-db
-
System Keychains, these can contain WiFi passwords registered by the local machine and several certifications and public/private keys.
- /Library/Keychains/System.keychain
- Note: The unlock file for this keychain is commonly located at /var/db/SystemKey
- /Library/Keychains/System.keychain
$ python ./chainbreaker.py --help
usage: chainbreaker.py [-h] [--dump-all] [--dump-keychain-password-hash]
[--dump-generic-passwords] [--dump-internet-passwords]
[--dump-appleshare-passwords] [--dump-private-keys]
[--dump-public-keys] [--dump-x509-certificates]
[--export-keychain-password-hash]
[--export-generic-passwords]
[--export-internet-passwords]
[--export-appleshare-passwords] [--export-private-keys]
[--export-public-keys] [--export-x509-certificates]
[--export-all] [--check-unlock-options]
[--password-prompt] [--password PASSWORD]
[--key-prompt] [--key KEY] [--unlock-file UNLOCK_FILE]
[--output OUTPUT] [-d]
keychain
Dump items stored in an OSX Keychain
positional arguments:
keychain Location of the keychain file to parse
optional arguments:
-h, --help show this help message and exit
Dump Actions:
--dump-all, -a Dump records to the console window.
--dump-keychain-password-hash
Dump the keychain password hash in a format suitable
for hashcat or John The Ripper
--dump-generic-passwords
Dump all generic passwords
--dump-internet-passwords
Dump all internet passwords
--dump-appleshare-passwords
Dump all appleshare passwords
--dump-private-keys Dump all private keys
--dump-public-keys Dump all public keys
--dump-x509-certificates
Dump all X509 certificates
Export Actions:
Export records to files. Save location is CWD, but can be overridden with
--output / -o
--export-keychain-password-hash
Save the keychain password hash to disk
--export-generic-passwords
Save all generic passwords to disk
--export-internet-passwords
Save all internet passwords to disk
--export-appleshare-passwords
Save all appleshare passwords to disk
--export-private-keys
Save private keys to disk
--export-public-keys Save public keys to disk
--export-x509-certificates
Save X509 certificates to disk
--export-all, -e Save records to disk
Misc. Actions:
--check-unlock-options, -c
Only check to see if the provided unlock options work.
Exits 0 on success, 1 on failure.
Unlock Options:
--password-prompt, -p
Prompt for a password to use in unlocking the keychain
--password PASSWORD Unlock the keychain with a password, provided on the
terminal.Caution: This is insecure and you should
likely use--password-prompt instead
--key-prompt, -k Prompt for a key to use in unlocking the keychain
--key KEY Unlock the keychain with a key, provided via
argument.Caution: This is insecure and you should
likely use --key-prompt instead
--unlock-file UNLOCK_FILE
Unlock the keychain with a key file
Output Options:
--output OUTPUT, -o OUTPUT
Directory to output exported records to.
-d, --debug Print debug information
./chainbreaker.py --password=TestPassword -a test_keychain.keychain
2020-11-12 15:58:18,925 - INFO -
ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker
2020-11-12 15:58:18,925 - INFO - Runtime Command: chainbreaker.py --password=TestPassword -a test_keychain.keychain
2020-11-12 15:58:18,925 - INFO - Keychain: test_keychain.keychain
2020-11-12 15:58:18,925 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc
2020-11-12 15:58:18,925 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441
2020-11-12 15:58:18,925 - INFO - Dump Start: 2020-11-12 15:58:18.925479
2020-11-12 15:58:19,245 - INFO - 1 Keychain Password Hash
2020-11-12 15:58:19,245 - INFO - $keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5
2020-11-12 15:58:19,245 - INFO -
2020-11-12 15:58:19,245 - INFO - 2 Generic Passwords
2020-11-12 15:58:20,306 - INFO - [+] Generic Password Record
2020-11-12 15:58:20,306 - INFO - [-] Create DateTime: 2020-10-13 23:01:17
2020-11-12 15:58:20,306 - INFO - [-] Last Modified DateTime: 2020-10-13 23:01:17
2020-11-12 15:58:20,306 - INFO - [-] Description: secure note
2020-11-12 15:58:20,306 - INFO - [-] Creator:
2020-11-12 15:58:20,306 - INFO - [-] Type: note
2020-11-12 15:58:20,307 - INFO - [-] Print Name: Test Secure Note
2020-11-12 15:58:20,307 - INFO - [-] Alias:
2020-11-12 15:58:20,307 - INFO - [-] Account:
2020-11-12 15:58:20,307 - INFO - [-] Service: Test Secure Note
2020-11-12 15:58:20,307 - INFO - [-] Base64 Encoded Password: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+Tk9URTwva2V5PgoJPHN0cmluZz5UaGlzIGlzIGEgdGVzdCBzZWN1cmUgbm90ZS4gSSBkb27igJl0IGtub3cgdGhhdCBDaGFpbmJyZWFrZXIgd2lsbCBiZSBhYmxlIHRvIHNlZSBpdOKApjwvc3RyaW5nPgoJPGtleT5SVEZEPC9rZXk+Cgk8ZGF0YT4KCWNuUm1aQUFBQUFBREFBQUFBZ0FBQUFjQUFBQlVXRlF1Y25SbUFRQUFBQzdUQVFBQUt3QUFBQUVBQUFETEFRQUFlMXh5CglkR1l4WEdGdWMybGNZVzV6YVdOd1p6RXlOVEpjWTI5amIyRnlkR1l5TlRFekNseGpiMk52WVhSbGVIUnpZMkZzYVc1bgoJTUZ4amIyTnZZWEJzWVhSbWIzSnRNSHRjWm05dWRIUmliRnhtTUZ4bWJtbHNYR1pqYUdGeWMyVjBNQ0JJWld4MlpYUnAKCVkyRk9aWFZsTFV4cFoyaDBPMzBLZTF4amIyeHZjblJpYkR0Y2NtVmtNalUxWEdkeVpXVnVNalUxWEdKc2RXVXlOVFU3CglYSEpsWkRCY1ozSmxaVzR3WEdKc2RXVXdPMzBLZTF3cVhHVjRjR0Z1WkdWa1kyOXNiM0owWW13N08xeGpjM055WjJKYwoJWXpCY1l6QmNZekJjWTI1aGJXVWdkR1Y0ZEVOdmJHOXlPMzBLWEhCaGNtUmNkSGcxTmpCY2RIZ3hNVEl3WEhSNE1UWTQKCU1GeDBlREl5TkRCY2RIZ3lPREF3WEhSNE16TTJNRngwZURNNU1qQmNkSGcwTkRnd1hIUjROVEEwTUZ4MGVEVTJNREJjCglkSGcyTVRZd1hIUjROamN5TUZ4d1lYSmthWEp1WVhSMWNtRnNYSEJoY25ScFoyaDBaVzVtWVdOMGIzSXdDZ3BjWmpCYwoJWm5NeU5pQmNZMll5SUZSb2FYTWdhWE1nWVNCMFpYTjBJSE5sWTNWeVpTQnViM1JsTGlCSklHUnZibHduT1RKMElHdHUKCWIzY2dkR2hoZENCRGFHRnBibUp5WldGclpYSWdkMmxzYkNCaVpTQmhZbXhsSUhSdklITmxaU0JwZEZ3bk9EVjlBUUFBCglBQ01BQUFBQkFBQUFCd0FBQUZSWVZDNXlkR1lRQUFBQXZUR0dYN1lCQUFBQUFBQUFBQUFBQUE9PQoJPC9kYXRhPgo8L2RpY3Q+CjwvcGxpc3Q+Cg==
2020-11-12 15:58:20,307 - INFO -
2020-11-12 15:58:20,307 - INFO -
2020-11-12 15:58:20,331 - INFO - [+] Generic Password Record
2020-11-12 15:58:20,331 - INFO - [-] Create DateTime: 2020-09-24 23:34:14
2020-11-12 15:58:20,331 - INFO - [-] Last Modified DateTime: 2020-09-29 21:54:55
2020-11-12 15:58:20,331 - INFO - [-] Description:
2020-11-12 15:58:20,332 - INFO - [-] Creator:
2020-11-12 15:58:20,332 - INFO - [-] Type:
2020-11-12 15:58:20,332 - INFO - [-] Print Name: Stored Test Password
2020-11-12 15:58:20,332 - INFO - [-] Alias:
2020-11-12 15:58:20,332 - INFO - [-] Account: TestUser
2020-11-12 15:58:20,332 - INFO - [-] Service: Stored Test Password
2020-11-12 15:58:20,332 - INFO - [-] Password: TestPasswordValue123!
2020-11-12 15:58:20,332 - INFO -
2020-11-12 15:58:20,332 - INFO -
2020-11-12 15:58:20,332 - INFO - 1 Internet Passwords
2020-11-12 15:58:20,356 - INFO - [+] Internet Record
2020-11-12 15:58:20,356 - INFO - [-] Create DateTime: 2020-09-29 22:21:51
2020-11-12 15:58:20,356 - INFO - [-] Last Modified DateTime: 2020-09-29 22:21:51
2020-11-12 15:58:20,356 - INFO - [-] Description:
2020-11-12 15:58:20,356 - INFO - [-] Comment:
2020-11-12 15:58:20,356 - INFO - [-] Creator:
2020-11-12 15:58:20,356 - INFO - [-] Type:
2020-11-12 15:58:20,356 - INFO - [-] PrintName: example.com
2020-11-12 15:58:20,356 - INFO - [-] Alias:
2020-11-12 15:58:20,357 - INFO - [-] Protected:
2020-11-12 15:58:20,357 - INFO - [-] Account: TestUsername
2020-11-12 15:58:20,357 - INFO - [-] SecurityDomain:
2020-11-12 15:58:20,357 - INFO - [-] Server: example.com
2020-11-12 15:58:20,357 - INFO - [-] Protocol Type: kSecProtocolTypeHTTPS
2020-11-12 15:58:20,357 - INFO - [-] Auth Type: kSecAuthenticationTypeDefault
2020-11-12 15:58:20,357 - INFO - [-] Port: 0
2020-11-12 15:58:20,357 - INFO - [-] Path:
2020-11-12 15:58:20,357 - INFO - [-] Password: TestPassword123!
2020-11-12 15:58:20,357 - INFO -
2020-11-12 15:58:20,357 - INFO -
2020-11-12 15:58:20,357 - INFO - 0 Appleshare Passwords
2020-11-12 15:58:20,357 - INFO - 0 Private Keys
2020-11-12 15:58:20,357 - INFO - 0 Public Keys
2020-11-12 15:58:20,357 - INFO - 1 x509 Certificates
2020-11-12 15:58:20,357 - INFO - [+] X509 Certificate
2020-11-12 15:58:20,357 - INFO - [-] Print Name: Apple Root CA
2020-11-12 15:58:20,358 - INFO - [-] Certificate: MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmELes2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRrEdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6wsIG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCSC7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CWQYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMUZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggrBgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvMIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9saWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVudHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J20ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNiiPvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh
2020-11-12 15:58:20,358 - INFO -
2020-11-12 15:58:20,358 - INFO -
2020-11-12 15:58:20,358 - INFO -
ChainBreaker 2 - https://github.com/gaddie-3/chainbreaker
2020-11-12 15:58:20,358 - INFO - Runtime Command: chainbreaker.py --password=TestPassword -a test_keychain.keychain
2020-11-12 15:58:20,358 - INFO - Keychain: test_keychain.keychain
2020-11-12 15:58:20,358 - INFO - Keychain MD5: eb3abc06c22afa388ca522ea5aa032fc
2020-11-12 15:58:20,358 - INFO - Keychain 256: 2d76f564ac24fa6a8a22adb6d5cb9b430032785b1ba3effa8ddea38222008441
2020-11-12 15:58:20,358 - INFO - Dump Start: 2020-11-12 15:58:18.925479
2020-11-12 15:58:20,358 - INFO - Dump Summary:
2020-11-12 15:58:20,358 - INFO - 1 Keychain Password Hash
2020-11-12 15:58:20,358 - INFO - 2 Generic Passwords
2020-11-12 15:58:20,358 - INFO - 1 Internet Passwords
2020-11-12 15:58:20,358 - INFO - 0 Appleshare Passwords
2020-11-12 15:58:20,358 - INFO - 0 Private Keys
2020-11-12 15:58:20,359 - INFO - 0 Public Keys
2020-11-12 15:58:20,359 - INFO - 1 x509 Certificates
2020-11-12 15:58:20,359 - INFO - Dump End: 2020-11-12 15:58:20.358259
The password used to encrypt a keychain can be dumped using the --dump-keychain-password-hash option.
$ ./chainbreaker.py --dump-keychain-password-hash ./test_keychain.keychain
Keychain Password Hash
$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5
After obtaining the keychain password hash, you can use a program such as hashcat to attempt to crack it.
> hashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt
hashcat (v6.1.1) starting...
[...]
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP
[...]
$keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1*28dcfa41552db4eb*9dbb91712bb6a38f46e1b4335c334d444eb0c451e51fa02183eafe05c35310d76014bc04b699d420d8487d4452d067e5:TestPassword
Session..........: hashcat
Status...........: Cracked
Hash.Name........: Apple Keychain
Hash.Target......: $keychain$*7255a69abe21a28e1d2967265c9bba9c9bf4daf1...d067e5
[...]
Note: As described in hashcat #2457 collisions are very common based on the current checks. To combat this, you'll want to use the "--keep-guessing" flag, and keep trying the found passwords until you (hopefully) get the correct one.
Volofax can be used to extract Keychain files and master key candidates from memory images.
$ python vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump
[+] Find MALLOC_TINY heap range (guess)
[-] range 0x7fef03400000-0x7fef03500000
[...]
[-] range 0x7fef04900000-0x7fef04a00000
[*] Search for keys in range 0x7fef03400000-0x7fef03500000 complete. master key candidates : 0
[...]
[*] Search for keys in range 0x7fef04900000-0x7fef04a00000 complete. master key candidates : 6
[*] master key candidate: 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9
[...]
[*] master key candidate: 903C49F0FE0700C0133749F0FE0700404158544D00000000
$ ./chainbreaker.py --key 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9 ./test_keychain.keychain
Additional examples can be found in this gist by n0fate.
Chainbreaker2 was forked to be heavily refactored and modified from the original chainbreaker.
The primary reason behind this fork is to add better support integration into third-party forensic platforms such as Autopsy.
During the refactor, additional functionality was added including:
- Enhanced user control and options
- Extraction of the Keychain hash for use with third-party hash cracking software.
- Dumping all available information, regardless of the presence of an unlocking method
- Chainbreaker2 has been significantly refactored and with accitional functionality added by Luke Gaddie
- The original author of chainbreaker is n0fate
- Better commenting of code.
- Better documentation of the keychain format.