search

n0fate / chainbreaker

Mac OS X Keychain Forensic Tool
GNU General Public License v2.0
816 stars 157 forks source link

Question about system and user keychain #4

Closed AlessandroZ closed 6 years ago

AlessandroZ commented 6 years ago

@n0fate, I have a question that I cannot understand.

When you open the keychain using the "Keychain Access" applicaton on a Mac, you could unlock all keychains (in my case, I have "Login", "Local Items" and "System") using your system password (of course I assume you do not change the password of the keychain after the creation).

However, using chainbreaker, I could decrypt the user keychain using the password system account, however it does not work when I try to decrypt the system keychain (whereas using the "Keychain Access" application, it works).

At contrary, it's the same problem to decrypt the system keychain, it works using the system key but this key does not work to decrypt the user keychain.

So I cannot understand why "Keychain Access" manage to do it ?

Another thing, does user have user key (such as the system key stored on /private/var/db/SystemKey) and where I can find it? When I see your Readme, you manage with volafox to retrieve multiple master keys from memory:

[*] master key candidate: 78006A6CC504140E077D62D39F30DBBAFC5BDF5995039974
[*] master key candidate: 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9
[*] master key candidate: 2DD97A4ED361F492C01FFF84962307D7B82343B94595726E

And then you decrypt the user keychain using one of these key: 

python chainbreaker.py -f ~/Desktop/show/login.keychain -k 26C80BE3346E720DAA10620F2C9C8AD726CFCE2B818942F9

So I guess that there are a system key and a user key stored in two different places and both keychains are encrypted using these two different keys.

I tried to understand by myself without success so if you could help to understand this behaviour it would be awesome.

Thanks for your time !

n0fate commented 6 years ago

So I cannot understand why "Keychain Access" manage to do it ?

The key stored on /var/db/SystemKey of System Keychain is loaded on to the physical memory when OS is booted. The Keychain Access can decrypt system keychain info though the key on physical memory. It is most like sudo.

Another thing, does user have user key (such as the system key stored on /private/var/db/SystemKey) and where I can find it?

  1. I don't know what process or kext is stored it. So the keychaindump module of volafox use a pattern matching in kernel memory area on memory. I recommend you to read article as following: Breaking into the OS X Keychain written by juuso salonen
AlessandroZ commented 6 years ago

Thank you for your time. I was confused about the Keychain mechanism. I will take a look on the document. Have a nice day.