Cracking hashes
Once we have extracted the hash from the keychain, we can use John or hashcat to crack this hash. John will use the $keychain$ string in the keychain2john output to help it understand the correct hash type. From there, we just need to supply a wordlist, rules (if desired), and the hash, as shown in Figure 5.7:
Figure 5.7 – John being run against the keychain hash from our target system
In this example, we have used a modified version of the RockYou wordlist for demonstration purposes. Also, note that the way that keychain hashes are checked during the cracking operation can result in false positives (essentially, the compare operation is looking at a 4-byte padding value, which is small enough that hash collisions can arise); as such, we want to ensure that we completely exhaust our wordlists, which John will do by default.
To perform the same cracking in hashcat, we need to use mode 23100. Unlike John, we will need to direct...
