Breaking EncFS given .encfs6.xml

Question

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the password - even if I'm absolutely not expert in system security.

The only way I know to break a password is with brute force attacks.

Given an EncFS folder including the .encfs6.xml file, it is possible to test if a password is correct or not by just mounting the folder and providing the password, like has been done here.

But I noticed that this kind of attack is very slow. I would like to try a parallel attack and use a GPU to test the passwords.

I know that to perform "quickly" an attack over the password, is better to get "something" for example the hash of the password, and just compute the hash over the putative passwords until a matching one is found.

But I don't know how EncFS works: I know that .encfs6.xml is fundamental to decrypt the data, but I don't know what data it contains and how to use it to parallelize my attack.

How does EncFS encrypt the data and how can I use the content of .encfs6.xml to test if a password is valid, without having to run the encfs utility? (Or, where in the EncFS code I can find the relevant information to answer this question?)

EDIT:

I am also considering to use openssl for the attack, but I still have to figure out how to use .encf6.xml information in the command line openssl tool. Not even sure about which algorithm to use: aes-256-what??

Answer 1

Create encfs directory (optional, added to create an initial test setup)

 TMPDIR=$(mktemp -d)
 cd ${TMPDIR}
 mkdir ${TMPDIR}/encrypted
 mkdir ${TMPDIR}/mount_point
 encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

As an example, let's set the password to "correcthorsebatterystaple".

You should now have the following files:

$ find
.
./encrypted
./encrypted/.encfs6.xml
./mount_point

And you should be able to mount the directory as follows:

encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

(There might be permission errors because it is in /tmp. Just ignore that, as it is not necessary for the cracking itself.)

Install "John the ripper" and "crunch"

1. Get the latest John the ripper from:

   • https://www.openwall.com/john/

   • or https://github.com/magnumripper/JohnTheRipper

   Let's assume you installed it in a directory referred to by ${JOHN}.

2. Install "crunch" to generate wordlists:

   sudo apt install crunch

Crack the password

1. Create the hash file for John the ripper:

   ${JOHN}/encfs2john.py ${TMPDIR}/encrypted/ > ${TMPDIR}/encfs6.xml.john

2. Start cracking:

   1. Using a generated wordlist:

      1. Create a wordlist using crunch:

         crunch 2 4 -o wordlist.txt -p staple battery horse correct

         This generates a file wordlist.txt containing all possible orderings of the passed words:

         batterycorrecthorsestaple
         batterycorrectstaplehorse
         batteryhorsecorrectstaple
         ...
         staplecorrecthorsebattery
         staplehorsebatterycorrect
         staplehorsecorrectbattery
         

         See here for a better more extensive way of doing it: Passwordlist generation, permutations and long passwords

      2. Run John the ripper using the wordlist:

         Command:

         ${JOHN}/john --wordlist=wordlist.txt --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

         Output:

         Using default input encoding: UTF-8
         Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
         Will run 8 OpenMP threads
         Press 'q' or Ctrl-C to abort, almost any other key for status
         0g 0:00:00:00 DONE (2020-02-13 21:51) 0g/s 0p/s 0c/s 0C/s
         correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
         1g 0:00:00:01 DONE (2020-02-13 21:51) 0.8695g/s 20.86p/s 20.86c/s 20.86C/s batterycorrecthorsestaple..staplehorsecorrectbattery
         Use the "--show" option to display all of the cracked passwords reliably
         Session completed

   2. Using the "mask mode":

      This mode allows you to specify a set of characters, a minimum and maximum length and a mask containing known password parts. See here for more details: https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/MASK

      Command:

      ${JOHN}/john --min-length=25 --max-length=25 -2='eolabpcrsthy' -mask='correct?2?2?2sebatterystaple' --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

      Output:

      Using default input encoding: UTF-8
      Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
      Will run 8 OpenMP threads
      Press 'q' or Ctrl-C to abort, almost any other key for status
      0g 0:00:00:00  (25) 0g/s 0p/s 0c/s 0C/s
      0g 0:00:00:02 3.70% (25) (ETA: 21:50:48) 0g/s 27.46p/s 27.46c/s 27.46C/s correctbpesebatterystaple..correctyresebatterystaple
      0g 0:00:00:05 9.26% (25) (ETA: 21:50:48) 0g/s 28.57p/s 28.57c/s 28.57C/s correctboosebatterystaple..correctyaosebatterystaple
      0g 0:00:00:09 14.81% (25) (ETA: 21:50:53) 0g/s 28.41p/s 28.41c/s 28.41C/s correctbtosebatterystaple..correctyyosebatterystaple
      0g 0:00:00:11 18.52% (25) (ETA: 21:50:52) 0g/s 28.59p/s 28.59c/s 28.59C/s correctsllsebatterystaple..correctaplsebatterystaple
      0g 0:00:00:14 24.07% (25) (ETA: 21:50:52) 0g/s 28.74p/s 28.74c/s 28.74C/s correctshlsebatterystaple..correctaoasebatterystaple
      0g 0:00:00:17 29.63% (25) (ETA: 21:50:51) 0g/s 28.84p/s 28.84c/s 28.84C/s correctscasebatterystaple..correctatasebatterystaple
      0g 0:00:00:21 35.19% (25) (ETA: 21:50:52) 0g/s 28.89p/s 28.89c/s 28.89C/s correctslbsebatterystaple..correctapbsebatterystaple
      0g 0:00:00:23 38.89% (25) (ETA: 21:50:53) 0g/s 28.95p/s 28.95c/s 28.95C/s correctesbsebatterystaple..correctrhbsebatterystaple
      0g 0:00:00:26 44.44% (25) (ETA: 21:50:52) 0g/s 28.97p/s 28.97c/s 28.97C/s correctebpsebatterystaple..correctrcpsebatterystaple
      0g 0:00:00:29 50.00% (25) (ETA: 21:50:52) 0g/s 29.01p/s 29.01c/s 29.01C/s correcteecsebatterystaple..correctrlcsebatterystaple
      0g 0:00:00:33 55.56% (25) (ETA: 21:50:52) 0g/s 29.04p/s 29.04c/s 29.04C/s correctescsebatterystaple..correctrhcsebatterystaple
      0g 0:00:00:35 59.26% (25) (ETA: 21:50:53) 0g/s 29.06p/s 29.06c/s 29.06C/s correctborsebatterystaple..correctyarsebatterystaple
      correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
      1g 0:00:00:36 DONE (25) (2020-02-13 21:50) 0.02746g/s 29.00p/s 29.00c/s 29.00C/s correctborsebatterystaple..correctyarsebatterystaple
      Use the "--show" option to display all of the cracked passwords reliably
      Session completed

      Here -2 specifies the set of characters, while ?2 specifies where in the mask to use them.

Notes

1. Checking the passwords found:

   Command:

   ${JOHN}/john --pot=cracked_passwords.pot --show ${TMPDIR}/encfs6.xml.john

   Output:

   /tmp/tmp.ZGtxLjHUQi/encrypted/:correcthorsebatterystaple
     1 password hash cracked, 0 left

   You can also just use cat cracked_passwords.pot.

2. You can continue a canceled cracking run with:

   ${JOHN}/john --restore

3. John the ripper options:

   • --progress-every=N : emit a status line every N seconds

   • --pot=NAME : pot filename to use

     By default, John will use ${JOHN}/john.pot. This override allows using a different john.pot-like file (to start from, and to store any found password into).

     cf: https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/OPTIONS

4. hashcat might be faster then John the ripper, but it does not seem to support encfs yet.