Chainbreaker

From aldeid
Jump to navigation Jump to search

Description

The chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner. Master Key candidates can be extracted from volafox or volatility keychaindump module.

Installation

$ git clone https://github.com/n0fate/chainbreaker.git

Usage

Syntax

$ python chainbreaker.py [-h] -f FILE (-k KEY [KEY ...] | -u UNLOCKFILE | -p PASSWORD)

Options

-h, --help
show this help message and exit
-f FILE, --file FILE
Keychain file(*.keychain)
-k KEY [KEY ...], --key KEY [KEY ...]
Keychain Masterkey
-u UNLOCKFILE, --unlockfile UNLOCKFILE
System.keychain unlock file (/var/db/SystemKey)
-p PASSWORD, --password PASSWORD
Keychain Password

Example

$ python chainbreaker/chainbreaker.py  -f login.keychain-db -p "****ns1ccl4v13"
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:28
 [-] Last Modified DateTime: 2019-04-15 11:48:28
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : ids: identity-rsa-public-key
 [-] Alias : 
 [-] Account : identity-rsa-public-key
 [-] Service : ids
�0�] Pas*�H��: 0�"0
��`�U~���筝����MS���F�4���L�
                            �
                             �B▒��z�f�A����B
o���9���c`▒����!����M�M���s�T��)[email protected]�E�/�
J2�:���<��E���U��nӌ     ��J=��V㺅R��7�G+�-;2�e��LD/ܐ���o�����U��'[��(T�Fʋ��     ��
�|"c����L�
          ��    ��:=g�Zh�B`�����y��9Y���r~����9�E2A2©7����/C���
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:28
 [-] Last Modified DateTime: 2019-04-15 11:48:28
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : ids: identity-rsa-private-key
 [-] Alias : 
 [-] Account : identity-rsa-private-key
 [-] Service : ids
 [-] Password: 0����`�U~���筝����MS���F�4���L�
                                              �
                                               �B▒��z�f�A����B
o���9���c`▒����!����M�M���s�T��)[email protected]�E�/�
J2�:���<��E���U��nӌ     ��J=��V㺅R��7�G+�-;2�e��LD/ܐ���o�����U��'[��(T�Fʋ��     ��
�|"c����L�
          ��    ��:=g�Zh�B`�����y��9Y���r~����9�E2A2©7����/C�����#%`�����j���J"�-F���
���U���W:i���O�\h�W���m Gz��o����5#h�d�g�▒�be(��

��#�2�`�Ҍ�ޣt
d��rnd�'�$"7�#���Ch�
                    �z�
                       �ޟb��[email protected] 5T�&����=J]�������嚼���W�����p��"�k䳠h�����x�Tʀ�kK��;���ѩ��S��P�g��3����i���?7�
                                                                                                               �y���P���9����7e�J|l򨊥J$�w�Y��( �`�P��e��p�M�c�%2���/��Ln񮧭Ѯ������RA*�/��'�K<�x
`��׏T�g�<��b����!T�f"�\����k�q(��=eg��BiAӄ�[.�Z7=�S���6��2#L���p▒�V�A�#D�v=�����B��'��L��4q�'�Q$������{�_ql���6+G��n���X������@���B)9�L�t���0����b�`ݨTjE�▒"`�n�Ί��{ҷ=� 5�e�w�'��z
                                                                                          ?�Lb����J���F�s��K���e�7�p�ڪ���Z�
                                                                                                                           �qyPNp�6��>M�dx���?��ص�x��}���FW
                                                                                                                                                           2^-��s����\�k        ��QH�#���a�*�B�1▒�e����cޤ�)�h���)/<s���Q▒Yb�a�rH�-�Xg�C��g��>��    ���9��(c        �L�{�9{=���L�Lb��       2����z;ڼLRh%��R��P�
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:28
 [-] Last Modified DateTime: 2019-04-15 11:48:28
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : ids: identity-rsa-key-pair-signature-v1
 [-] Alias : 
 [-] Account : identity-rsa-key-pair-signature-v1
 [-] Service : ids
 [-] Password: 3764C1DA-3C0F-4DE0-BC1A-CA56C3FF9D78
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:29
 [-] Last Modified DateTime: 2019-04-15 11:48:29
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : ids: unregistered-message-protection-key
 [-] Alias : 
 [-] Account : unregistered-message-protection-key
 [-] Service : ids
 [-] Password: �ssui ���Ԅ��!"dbnm&~/Library/Keychains/login.keychain-dbitem{▒�'XhO�@g�Y����:�!'{87191ca2-0fc9-11d4-849a-000502b52122A��q�A��7�K��߉؟k<���m����HAÓ�3�h
                                                                                                                                                                    >gr?�κ6�D�X;
                                                                                                                                                                                [N��h,�T�V�ssui ���Ԅ��!"dbnm&~/Library/Keychains/login.keychain-dbitem{��
              ��������h�J~�[�'{87191ca2-0fc9-11d4-849a-000502b52122�0�������x:����2�nsJ?�#XM�M[�H�
�^      ۶�A�\▒~��9��f����k��D���yBp�KǏјx�:F:K ����rBE�)]cM��G��'u�5�h�A{���e�N�G������j]�l�[email protected]�3��4▒'S�5��B
                                                                                                              '�Yn�2,"��        +
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:29
 [-] Last Modified DateTime: 2019-04-15 11:48:29
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.ids: localdevice88c6e0e4-0371-409e-a73c-f793db45ab52-AuthToken
 [-] Alias : 
 [-] Account : localdevice88c6e0e4-0371-409e-a73c-f793db45ab52-AuthToken
 [-] Service : com.apple.ids
 [-] Password: 8B5D1052-0A7A-4E2B-A36F-FA909526A7F2
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:30
 [-] Last Modified DateTime: 2019-04-15 11:48:30
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : Apple Persistent State Encryption
 [-] Alias : 
 [-] Account : Window Bitmap Encryption
 [-] Service : Apple Persistent State Encryption
 [-] Password: 1541E930A7182180A31E3CCF3FFB1772
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:56:43
 [-] Last Modified DateTime: 2019-04-15 11:56:43
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : Safari Forms AutoFill Encryption Key
 [-] Alias : 
 [-] Account : 
 [-] Service : Safari Forms AutoFill Encryption Key
 [-] Password: DMZllTiRUxGIPEzhVE87Nw==
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:59
 [-] Last Modified DateTime: 2019-04-15 13:22:35
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.assistant
 [-] Alias : 
 [-] Account : 48096B92-6345-4A49-B298-DE4BA1D93C1E - Validation Data
 [-] Service : com.apple.assistant
 [-] Password: 1
                ���!�L��\.r��ŀ!���0�P`��,�C�<�k�7� 
                                                   4J-�y������ΰ�_T[���l)u���y;#�<��]��[���J�����@�����eD�}����<��a�Z�x��V��愋�����d�o��PVjmR �!tي&�L�x%�Y�mv���H▒�l��&��U�񊈎��g;{������@�h����,�m�{?��$�j�
��                                                                                                                                                                                                       ��BA�nj��7�Z���t����gZ)L
  �▒rqݏ�_�����q`�T�$e�3Z��
                          ���Dɬ����ݬ�S��@��     PN�o�N����E�ΔL��Ľi�d^��CQ=#�c��5�5k�Γ�ڎ(|�     �g���#�t�Iʠ�fW▒ˀ#d�]���,��L�rK8�.��t%C�8
                                                                                                                                        �'sv�"�s�.p���Eč��8�RR�����jM�[ �V�|��;���/��ޏ�-��s�IS������ϵY�����d���M�1���l��B%B�▒h�C����N�>�h��▒�9��2��q����]'UM�&h+H�:�}
                          ��-i~����V�y1�3%�>�98ggX'$��c{���cy����Z F7\I[B�v▒p�-�
�9f���u^�Y"k|E�����
                   m��zU���3����L�d▒�k��L�'"<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Assistant Identifier</key>
        <string>D45843A4-8029-4B53-94CB-4E40CA125F5A</string>
</dict>
</plist>
O�����2�E�����E�����6'a�3.�������
                                 Y�\�����{Q�)�vzh �6�{��WCAg��"n���
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:48:59
 [-] Last Modified DateTime: 2019-04-15 13:22:35
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.assistant
 [-] Alias : 
 [-] Account : 48096B92-6345-4A49-B298-DE4BA1D93C1E - Assistant Identifier
 [-] Service : com.apple.assistant
 [-] Password: D45843A4-8029-4B53-94CB-4E40CA125F5A
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:49:07
 [-] Last Modified DateTime: 2019-04-15 11:49:07
 [-] Description : 
 [-] Creator : aapl
 [-] Type : 
 [-] PrintName : MetadataKeychain
 [-] Alias : 
 [-] Account : 
 [-] Service : MetadataKeychain
 [-] Password: uNB{@tUo\ulJ7qenV0La
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:49:51
 [-] Last Modified DateTime: 2019-04-15 11:49:51
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : Safari Session State Key
 [-] Alias : 
 [-] Account : 
 [-] Service : Safari Session State Key
 [-] Password: gHT0xlYPWu79VtEa8Fy9qQ==
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:49:00
 [-] Last Modified DateTime: 2019-04-15 13:22:35
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.assistant
 [-] Alias : 
 [-] Account : 48096B92-6345-4A49-B298-DE4BA1D93C1E - Host Creation UUID
 [-] Service : com.apple.assistant
 [-] Password: ����[email protected]��<���E�R
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:49:00
 [-] Last Modified DateTime: 2019-04-15 13:22:35
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.assistant
 [-] Alias : 
 [-] Account : 48096B92-6345-4A49-B298-DE4BA1D93C1E - Speech Identifier
 [-] Service : com.apple.assistant
 [-] Password: FAA8065B-2AC6-48AB-995E-2400BF19B1C1
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 12:03:13
 [-] Last Modified DateTime: 2019-04-15 12:03:13
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.account.Google.oath-refresh-token
 [-] Alias : 
 [-] Account : ******[email protected]
 [-] Service : com.apple.account.Google.oath-refresh-token
 [-] Password: 1/miHEgeE24-P7Cy4QhPMr0FAwKY8OtBy4ZqwEXPx5lls
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 12:03:13
 [-] Last Modified DateTime: 2019-04-15 12:03:13
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.account.Google.oauth-expiry-date
 [-] Alias : 
 [-] Account : ******[email protected]
 [-] Service : com.apple.account.Google.oauth-expiry-date
 [-] Password: 577081945.493610
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 12:03:13
 [-] Last Modified DateTime: 2019-04-15 12:03:13
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.account.Google.oauth-token
 [-] Alias : 
 [-] Account : ******[email protected]
 [-] Service : com.apple.account.Google.oauth-token
 [-] Password: ya29.GmDsBltJT656nE1tpaFzIV0BWmyxdzdjX5jB232fdea461HkZKuxW29BYuo1V-42WTGRGbXNiCwCDcpCpMSkplU0HRm_gA8Ixj4Lycd2kBBi1SMbLQEEYzH461dGDp0qfwo
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 12:07:15
 [-] Last Modified DateTime: 2019-04-15 12:07:15
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : gmail
 [-] Alias : 
 [-] Account : ******[email protected]
 [-] Service : gmail
 [-] Password: ih*****ple89
[+] Generic Password Record
 [-] Create DateTime: 2019-04-15 11:51:12
 [-] Last Modified DateTime: 2019-04-15 13:22:35
 [-] Description : 
 [-] Creator : 
 [-] Type : 
 [-] PrintName : com.apple.assistant
 [-] Alias : 
 [-] Account : 48096B92-6345-4A49-B298-DE4BA1D93C1E - Server Certificate Data
 [-] Service : com.apple.assistant
0b1] Pas*�H��: 0�0���0
   0    UUS10U

Apple Inc.1&0$U
190126190134Z0��1ple Certification Authority10U
                 0      UUS10U


Apple Inc.1&0$U

               Apple Certification Authority1907U
�0�     *�H��                                    0Apple System Integration Certification Authority0�"0
������X)�*
          ��Z1�-j,R���Ai�P&6z�
                              o9��▒V�<��6A���g`2
                                                N2}����S�▒��l�E��8��|�N±V�>�mmA▒��G��|-x���e�z�ݘ[email protected]��P��k�WU}'�
��秓����By?�2�vA)
��-t��I�{��=�Ϣ��#�f��~[�1w�     �~~����A�,��y��xD�;K���Ⰲ�2���>u7�u��1m� ��'���0��0U��0U�0�0U�0sc�����   2��yz�iPh0U#▒0�+�iG�v   ��k�[email protected]��G^06U/0-0+�)�'�%http://www.apple.com/appleca/root.crl0
�={��cd0*�H��
     "��K���+�h�
                ��$�-Ӳ��C��<�&ȭ�,�LUSI������rј����N���e�D��'*N����}�Aq����
3��+�sr���]�/4�k�OȊ��o%n������ N]VLI��$t~ɓ�4��ѧ���®i럟W�h����"�dAX�x����6jkD���[email protected]���u��3Q��jX?���\
0��1��UA*�H���P����r�R󯒭�.����&�ޔ�ټ=6�U�8�10�-0�K,�H�}�0
    0   UUS10U


Apple Inc.1&0$U

               Apple Certification Authority1907U
140324011332Z0i10                                0Apple System Integration Certification Authority0
                 DRM Technologies A011&0$U

                                          Apple Certification Authority10U


Apple Inc.1
�0�     *�H��   UUS0�"0
ȸ�[�m�B�@�$��".��q� kIA��`zƢ�Mz/��c��
��&��>0�]�8��HJIw�.����)}A�y����
                                 ؝i眲�F�K�      ▒P$�YG+"UG�Q"�B�����G��o
te����_K����m>@U����2��Q�ɹ�^�_�k�|:��h���4Ut��K��u���C��D#R?��!��?�
"&;՞I���0��0U�$#��莏q���bs=�^$  /0
                                  U�00U#▒0��0sc�����    2��yz�iPh0�U �0�0��     *�H��cd0��0+http://www.apple.com/appleca0�+0��
                                                                                                                              ��Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certificate policy and certification practice statements.0/U(0&0$�"� �http://crl.apple.com/asica.crl0U��0
*�H��cd
�}y�cnA;��α��m0 ��I0�=Uι�-Kb��@�����Ҧ��kO�F �³�,wO�DL��a-��C.7:7�����I��w�S����s�G� V6�٥�
                                                                                         <"y���O        }^��"���#%      �y�4V��E�"�U��/�!����s  v������B�_d���h? XBԟvm�����t�Z��Ǧ�V�7��r���D�F��$�'y�t�Ų���&����
                                                                                                                                                                                                                ٣��D���K2�R��*Z#4�����y
�
[!] Certification Table is not available
[+] Public Key Record
[+] Public Key Record
[+] Public Key Record
[+] Private Key Record, dumped to disk
[+] Private Key Record, dumped to disk
[+] Private Key Record, dumped to disk