Breaking the iCloud Keychain Artifacts
n0fate has released a new tool – it’s called iChainbreaker. As you can see, this Python script can be used for analyzing iCloud Keychain.
Here is how to use it:
usage: iChainbreaker.py [-h] -p PATH -k KEY [-x EXPORTFILE]
Tool for iCloud Keychain Analysis by @n0fate
-h, –help show this help message and exit
-p PATH, –path PATH iCloud Keychain Path(~/Library/Keychains/[UUID]/)
-k KEY, –key KEY User Password
-x EXPORTFILE, –exportfile EXPORTFILE
Write a decrypted contents to SQLite file (optional)
You can download the script here.