Forgot Password but not Entirely, does a Dictionary Attack Exist for Cryptomator?

Help
11

I don’t think you would get anywhere with hashcat, see: https://hashcat.net/forum/thread-7725.html

I vaguely remember that there was indeed a user that was in a similar situation and tried to brute-force his password. But that’s so long ago and I don’t know if we have any scripts anymore that we can re-use for your purpose, at least I couldn’t find anything.

Probably, the “easiest” way would be to use one of our libraries like cryptolib because it already implements the masterkey derivation we would need for a brute-force attempt. Otherwise, you would somehow need some code that can run scrypt and RFC 3394 key wrapping. But yeah, that requires some coding.

We’ll look into it, can’t promise you a quick solution as the others have already stated. In the meantime, try the following script:

#!/bin/sh
while read pw; do
  echo "--- TRYING: $pw"
  java -jar cryptomator-cli-0.4.0.jar --vault vault=/Users/saibot/Dropbox/Vault --password vault="$pw" --bind 127.0.0.1 --port 8080
done <pwlist.txt

And have a file called pwlist.txt next to script with one password each line. The script is kind of “dumb” but if you hit a correct password, the script will “pause” at that password and the last entry of --- TRYING: <pw> is then the password you were looking for.

4 Likes