During the 2026 Crack Me If You Can contest, challenge 4 contained four password-protected DMG files. dmg2john extracts hashes from all four without reporting an error, but the resulting hashes cannot be cracked even when the correct password is included in the wordlist.
Tested with bleeding-jumbo at commit 9a336d8 (latest as of this writing).
Challenge files can be downloaded from: https://contest-2026.korelogic.com/downloads/
Extract challenge 4
gpg --batch --passphrase '@u:302wbl:50[;FRiFt2' -d cmiyc_2026_challenge_4.tar.xz.pgp > cmiyc_2026_challenge_4.tar.xz
tar xf cmiyc_2026_challenge_4.tar.xz
This produces:
its_not_that_hard.dmg
lDK9QqIzhwk.dmg
start_with_this_one.dmg
wow_its_hot.dmg
Extract the hashes and create wordlist
run/dmg2john *.dmg > dmg.john
The password d3fc0n is known to be correct for at least one of these DMGs. Create a small wordlist containing it and variants:
printf 'defcon\nd3fc0n\n' > defcon.lst
run/john --stdout -w:defcon.lst -rule:single | run/unique defcon-expanded.lst
Verify d3fc0n is in the expanded list
grep -x d3fc0n defcon-expanded.lst
Run john
$ run/john -pot:defcon.pot -w:defcon-expanded.lst dmg.john
Warning: detected hash type "dmg", but the string is also recognized as "dmg-opencl"
Use the "--format=dmg-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (dmg, Apple DMG [PBKDF2-SHA1 256/256 AVX2 8x 3DES/AES])
Loaded hashes with cost 1 (iteration count) varying from 400000 to 476190
Cost 2 (version) is 2 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
0g 0:00:00:46 DONE (2026-08-13 04:03) 0g/s 43.27p/s 173.1c/s 173.1C/s Defcon1944..D3fc0n1900
Session completed
Hans Leininger (hlein) wrote in the post contest discord:
Minga probably knows more details, but IIRC it's bad in a bad way: it will extract a hash from current DMG formats w/o complaint, but what it spits out is not actually crackable. So you'll think you succeeded, but can't crack a DMG with password d3fc0n
Same results with dmg2john.py
Either these DMG formats should be supported correctly, or dmg2john should detect unsupported/incompatible DMG formats and report an error instead of silently producing uncrackable hashes.
During the 2026 Crack Me If You Can contest, challenge 4 contained four password-protected DMG files. dmg2john extracts hashes from all four without reporting an error, but the resulting hashes cannot be cracked even when the correct password is included in the wordlist.
Tested with bleeding-jumbo at commit 9a336d8 (latest as of this writing).
Challenge files can be downloaded from: https://contest-2026.korelogic.com/downloads/
Extract challenge 4
This produces:
Extract the hashes and create wordlist
run/dmg2john *.dmg > dmg.johnThe password d3fc0n is known to be correct for at least one of these DMGs. Create a small wordlist containing it and variants:
printf 'defcon\nd3fc0n\n' > defcon.lst
run/john --stdout -w:defcon.lst -rule:single | run/unique defcon-expanded.lst
Verify d3fc0n is in the expanded list
grep -x d3fc0n defcon-expanded.lst
Run john
Hans Leininger (hlein) wrote in the post contest discord:
Same results with dmg2john.py
Either these DMG formats should be supported correctly, or dmg2john should detect unsupported/incompatible DMG formats and report an error instead of silently producing uncrackable hashes.