2

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the password - even if I'm absolutely not expert in system security.

The only way I know to break a password is with brute force attacks.

Given an EncFS folder including the .encfs6.xml file, it is possible to test if a password is correct or not by just mounting the folder and providing the password, like has been done here.

But I noticed that this kind of attack is very slow. I would like to try a parallel attack and use a GPU to test the passwords.

I know that to perform "quickly" an attack over the password, is better to get "something" for example the hash of the password, and just compute the hash over the putative passwords until a matching one is found.

But I don't know how EncFS works: I know that .encfs6.xml is fundamental to decrypt the data, but I don't know what data it contains and how to use it to parallelize my attack.

How does EncFS encrypt the data and how can I use the content of .encfs6.xml to test if a password is valid, without having to run the encfs utility? (Or, where in the EncFS code I can find the relevant information to answer this question?)

EDIT:

I am also considering to use openssl for the attack, but I still have to figure out how to use .encf6.xml information in the command line openssl tool. Not even sure about which algorithm to use: aes-256-what??

  • 2
    A quick google on .encfs6.xml format returned a first link of unix.stackexchange.com/questions/184215/…. So we know that the file contains the encrypted key for your folder. You need your password to decrypt that key. I suspect that with a little research you can find the algorithm used to encrypt the key and reproduce it in an application. That should be faster. – Neil Smithline Aug 31 '15 at 15:59
  • Cracking your password is likely a sign that you are using an insufficiently random password generation algorithm and should find another for the future. – Neil Smithline Aug 31 '15 at 16:00
  • Thanks for the first comment, but I can't understand the second: if I have to crack it, isn't it a sign of the fact that doesn't follow a prefixed schema (i.e. easy to remember)? – AkiRoss Aug 31 '15 at 16:16
  • 2
    Secure passwords should be able to withstand large-CPU attacks. For example, a cracking attack done by a botnet. So if you can crack your password with one or only a few computers in a period of hours or days, it means that it isn't random enough. – Neil Smithline Aug 31 '15 at 16:22
1

Create encfs directory (optional, added to create an initial test setup)

 TMPDIR=$(mktemp -d)
 cd ${TMPDIR}
 mkdir ${TMPDIR}/encrypted
 mkdir ${TMPDIR}/mount_point
 encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

As an example, let's set the password to "correcthorsebatterystaple".

You should now have the following files:

$ find
.
./encrypted
./encrypted/.encfs6.xml
./mount_point

And you should be able to mount the directory as follows:

encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

(There might be permission errors because it is in /tmp. Just ignore that, as it is not necessary for the cracking itself.)

Install "John the ripper" and "crunch"

  1. Get the latest John the ripper from:

    Let's assume you installed it in a directory referred to by ${JOHN}.

  2. Install "crunch" to generate wordlists:

    sudo apt install crunch

Crack the password

  1. Create the hash file for John the ripper:

    ${JOHN}/encfs2john.py ${TMPDIR}/encrypted/ > ${TMPDIR}/encfs6.xml.john
  2. Start cracking:

    1. Using a generated wordlist:

      1. Create a wordlist using crunch:

        crunch 2 4 -o wordlist.txt -p staple battery horse correct

        This generates a file wordlist.txt containing all possible orderings of the passed words:

        batterycorrecthorsestaple
        batterycorrectstaplehorse
        batteryhorsecorrectstaple
        ...
        staplecorrecthorsebattery
        staplehorsebatterycorrect
        staplehorsecorrectbattery
        

        See here for a better more extensive way of doing it: Passwordlist generation, permutations and long passwords

      2. Run John the ripper using the wordlist:

        Command:

        ${JOHN}/john --wordlist=wordlist.txt --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

        Output:

        Using default input encoding: UTF-8
        Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
        Will run 8 OpenMP threads
        Press 'q' or Ctrl-C to abort, almost any other key for status
        0g 0:00:00:00 DONE (2020-02-13 21:51) 0g/s 0p/s 0c/s 0C/s
        correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
        1g 0:00:00:01 DONE (2020-02-13 21:51) 0.8695g/s 20.86p/s 20.86c/s 20.86C/s batterycorrecthorsestaple..staplehorsecorrectbattery
        Use the "--show" option to display all of the cracked passwords reliably
        Session completed
    2. Using the "mask mode":

      This mode allows you to specify a set of characters, a minimum and maximum length and a mask containing known password parts. See here for more details: https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/MASK

      Command:

      ${JOHN}/john --min-length=25 --max-length=25 -2='eolabpcrsthy' -mask='correct?2?2?2sebatterystaple' --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

      Output:

      Using default input encoding: UTF-8
      Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
      Will run 8 OpenMP threads
      Press 'q' or Ctrl-C to abort, almost any other key for status
      0g 0:00:00:00  (25) 0g/s 0p/s 0c/s 0C/s
      0g 0:00:00:02 3.70% (25) (ETA: 21:50:48) 0g/s 27.46p/s 27.46c/s 27.46C/s correctbpesebatterystaple..correctyresebatterystaple
      0g 0:00:00:05 9.26% (25) (ETA: 21:50:48) 0g/s 28.57p/s 28.57c/s 28.57C/s correctboosebatterystaple..correctyaosebatterystaple
      0g 0:00:00:09 14.81% (25) (ETA: 21:50:53) 0g/s 28.41p/s 28.41c/s 28.41C/s correctbtosebatterystaple..correctyyosebatterystaple
      0g 0:00:00:11 18.52% (25) (ETA: 21:50:52) 0g/s 28.59p/s 28.59c/s 28.59C/s correctsllsebatterystaple..correctaplsebatterystaple
      0g 0:00:00:14 24.07% (25) (ETA: 21:50:52) 0g/s 28.74p/s 28.74c/s 28.74C/s correctshlsebatterystaple..correctaoasebatterystaple
      0g 0:00:00:17 29.63% (25) (ETA: 21:50:51) 0g/s 28.84p/s 28.84c/s 28.84C/s correctscasebatterystaple..correctatasebatterystaple
      0g 0:00:00:21 35.19% (25) (ETA: 21:50:52) 0g/s 28.89p/s 28.89c/s 28.89C/s correctslbsebatterystaple..correctapbsebatterystaple
      0g 0:00:00:23 38.89% (25) (ETA: 21:50:53) 0g/s 28.95p/s 28.95c/s 28.95C/s correctesbsebatterystaple..correctrhbsebatterystaple
      0g 0:00:00:26 44.44% (25) (ETA: 21:50:52) 0g/s 28.97p/s 28.97c/s 28.97C/s correctebpsebatterystaple..correctrcpsebatterystaple
      0g 0:00:00:29 50.00% (25) (ETA: 21:50:52) 0g/s 29.01p/s 29.01c/s 29.01C/s correcteecsebatterystaple..correctrlcsebatterystaple
      0g 0:00:00:33 55.56% (25) (ETA: 21:50:52) 0g/s 29.04p/s 29.04c/s 29.04C/s correctescsebatterystaple..correctrhcsebatterystaple
      0g 0:00:00:35 59.26% (25) (ETA: 21:50:53) 0g/s 29.06p/s 29.06c/s 29.06C/s correctborsebatterystaple..correctyarsebatterystaple
      correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
      1g 0:00:00:36 DONE (25) (2020-02-13 21:50) 0.02746g/s 29.00p/s 29.00c/s 29.00C/s correctborsebatterystaple..correctyarsebatterystaple
      Use the "--show" option to display all of the cracked passwords reliably
      Session completed

      Here -2 specifies the set of characters, while ?2 specifies where in the mask to use them.

Notes

  1. Checking the passwords found:

    Command:

    ${JOHN}/john --pot=cracked_passwords.pot --show ${TMPDIR}/encfs6.xml.john
    Output:
    /tmp/tmp.ZGtxLjHUQi/encrypted/:correcthorsebatterystaple
      1 password hash cracked, 0 left

    You can also just use cat cracked_passwords.pot.

  2. You can continue a canceled cracking run with:

    ${JOHN}/john --restore

  3. John the ripper options:

  4. hashcat might be faster then John the ripper, but it does not seem to support encfs yet.

| improve this answer | |
  • Thanks! It's fun to get the answer 5 years later, because I'm not even sure I still got the encrypted files, but if do, I will definitely try and see if I can get the data back :) +1 also for xkcd reference – AkiRoss Feb 16 at 14:16
  • I wanted to test the security of my own encFS password, but could not find a guide anywhere and found your post instead. So I answered after solving it. I tried princeprocessor to create a wordlist, but it seemed really slow. And I had used crunch last time for a very similar issue last year with ecryptFS. (lost access to my .Private dir) Still not cracked, but I keep the files around for whenever I have time and processing power. :) – KIAaze Feb 17 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.