Cracking metamask hash

[dbgdbg]

Greetings!

I created a metamask wallet with password from rockyou.txt (catanddog) and successfuly cracked the vault and obtained the password back using metamask vault decryptor binary.

I am although having troubles doing the same thing with hashcat Metamask -m 26620 kernel. I have successfully recompiled hashcat versions 6.x and 7.x with the new kernel module, but whenever i try to crack it with the new kernel module, there are issues tied to input hash format. Ive tried changing the hashcat input hash to several formats, but there is either always an issue with hash being in wrong format for input (no hashes loaded prompt) OR if i do manage to load it successfully it does not crack - so i malformed it with change.

Cannot seem to locate the exact issue and it does feel bizzare since the vault extractor straight up gives us ALL information available to crack. I wonder if kernel mode is even needed? Does one just have to change the hash into a proper format and it becomes crackable with 26600 mode?

In essence I need help to either crack the hash with new kernel mode or transform it to a format that 26600 can intake and crack.

[cyclone]

Keep in mind that hashcat v7.x recently added support for their own metamask wallet hash with dynamic iterations which is not compatible with the widely used 26620 kernel which I released back in March, 2024.

Now, to address your question:
The metamask_extractor will print two hashes:

1. metamask_decryptor format (can recover the password and seed phrase)

{"data": "","iv": "","keyMetadata": {"algorithm": "PBKDF2","params": {"iterations": }},"salt": ""}

2. hashcat 26600 or 26620 format (can be run with hashcat to recover only the password)

$metamask$600000$...$...$...

If you're still needing more help, post your test wallet output from metamask_extractor and we'll go from there (make sure to only post a test wallet with no balance and not a real wallet).

[dbgdbg]

This post is deleted!

[dbgdbg]

Please delete the upper message ill rather attach a txt file, accidentaly deleted the post.

metamask.txt

It would be excellent if you manage to elaborate how to transform this into a crackable 26600 hash format OR manage to get it working with 26620 kernel mode. Password is catanddog if you want to go with a shorter wordlist.

[cyclone]

@dbgdbg Deleted as requested. The issue was you need to comment out any lines that contain markdown code.
example:

commented out line

The tool already gave you a crackable hash under hashcat -m 26620 hash (NEW format):

$metamask$600000$xsq1OyKYinxYyiOUWyTVT820oedGQy+smC7EufhhEEg=$UuT70j+fJnU2tLU4bxZ35g==$I/DCva85GqSyhzTxlYLqjhacvnroBf2IAdFpanTaAd062T+T6UjivtLSyiawhbbe1un5UDDqasyVCtJwf/y32yaZ/zx67m3qz//s9wvYymXWicFWL81gLh3Tsqi/39v3E09ECpBcEezim8KmrdUB+zNwxjfufdzQ4RfrwOxY7FvD5wML7dI6G9hi18vWwbgz+SyJnjNA880VgKh/eV5YRjiEMUtGrcMfR/EXoPmvTpTsC4F3fUAPOtl1WW0TVqH1tdWLDwqH7g0F/Mo4TOOK7Ranfpm1D9LAg/UlWTLsh6a6f6TAUwBIqFvnZG1JEdB7m12brS1HJZh+y+wFWEzERTuvspbEBcOG2uqZAWiJG6HWQvua5OhhoawxSBff1l/kYRAdmBwT3Vt7Hk9HX4gIuebyKS+V7fk5QprNpw87eiiDcgM7fzhLwIzvt6cCDPZ2yLF8p/ycvDMwIQZf1mezYJbSHS1L7NYbxY5FJ/na2QDaojJr0FDJ0FKDX9UBB45T/MWZqeITXqW8vo3bQkuKeIG3B02Y4W3oRKw7EzfHCodVaZXnRL+Czem7sOIl9TFO4N250rztB2DRgkfsZh+OxCLjc02np/66OdJf5R9njFVHrJ4cX1ENCbn4miqeF40dS4hMqhLBNSTA+gKkd0aIZVvSL/MoaI9lyJQz4Mcgfxen6m52MDJu7cJajxXoiC1YOI+vhy1yj4qIaxHCDxhCQ380tcBxwJaxskqH7s/uokhQXs1eIYVbpX/ygDOh4e8ykSJu6e+HWki5WwBRW21O6V4d+jJDLr5mFgBHRdFGBVfaFQR/kLUedno7tXD6a+AGssGitQRMn7aQAbkOvdVwiMFmwpjvNXqxpdmK82oBMRWCOe9A03HpFrXTVkamu0OBZAbh+9CMJDcgPjcrrqwVQ8FkUwh3JrceiAkOzfFPSDswZJMItaj7o8i/gnaeaFXYn4Pcb/Wdyk4RsUocsOLEKekzPjZ/pzNxHpY++wmYXuODoL3UIqgZ8mq8GNWgMPFu/DSLeGHkY7XADJOPDz/befJo6Y0W4/yk84jFCaf2KuoH5BGufKYaS6KV2dtIbTaDTORfty0IkX/xEJVhFqA8W4421SvsE8bzHdxF7W6/UBqOeMJY0mBQXeyMoCxRWNQwhQ3H4TIXP0XTXIhc0kOZXlZPWhdMJS3xstGUR/2lGAWOWpn0g+wbksEaOVXFBHlMrXXfO1GrxWiklc7MnhJMmRZwBJR7EAPu/mY+jInmROycRjTpOPn481ueDUc1gIKPbk82RpEq6NH1pOohwHCjc7EJtgOUDePL3duuLNJYnvs7pDkkOrIO2oKsMW+XMTqZoTbmTM0a+ssZ0129LN73ar5vk2LrMlsHZeUUb8s7GuQjolZ8e3k7/y+jKdUjVKCgnUScH4LqhubdDQxCgxoHvsukNUrAzeb0EPR7Zbq0SeZxnJ4wd25ME+7QmWGeIgwPEMI0uWLbsQwLeJ63iv1XHmtkZnhcepZlDOGmTGCPnAkQyYReDFAGng3SEXA3tRY3uLNvfh7tExSknqfjpBKM3KARdh142grxbKT8RuHfC4e4WVkRZxWl/7QbFRl9BDi7rEMSeZCERojLFV8lSV8E6LmOuO1+r+NwVgCoDnE23XwPEXsqZOd7F4U3jtEIheXGe31i4z9wt/SisVKQuFR5A6wiVfENLyUimXq06YDY009TNEtXBrs+osTN7C/ECEXqzPxoatM3pDX8GE88RPgZCgPZGm3IyglCPBE9ptiyVss2acSF/X74V5ekujyuxopt32zh+SqvwuvhNOdxQZ99N0uq+1AfpuZOZ9bH6PcIPI9qR3hDoKXohWTs+moxz3m9taQ9XgX6qxab8D+i+qw3tVBnJi88FeLdS/OlWQJg5VE9juC5y5RpcoYR39LPOzRFEKK4K9LLAuHFpKuHZGfzIXKxeG4wBStVy7PvFLcqMCtsfJeYI+KPIuQvh1qydKHC5y7FkJNBTs0HIhskZ/RBRjib78Bkf010XUMCPcV6lxaD6qSu8Ko0caE6By4lNaSy0UaPVSIxjWZ6EZgjxVy3CYlR6BWIvsmX4djJQOgQx6+eT7ceV8bT6tDq7LhC46Z0nH+oUws/O+QApNAHSdZtFBzOd+xKqrX7p0ebXgrRaBH1KSoweFL6euRgpF/qVefN8JcKYodb42CYrmlWJZHk8X0ypGqPHZYFpDUkR3HaVxjE/2tg6tOTlh+RhKqeZHjYYKVVvtaFTjyelh/VqUkcmlYKhPOP1YOlAwFhYIFFpj094HY9jXWVsSoOlJG51279oHLGGusxQwhPP1FkzR73eYsr0ZjoAGrx2q1ztx7fynj+6AKdwmJf16x7+W17/uB6d9nESGAhlpe8SpZNovVVACkrFg3pn/yy1C8hJCcMmU1dVP5BjX8pn97LBJeWaPkgwG0a6T1qqqThzx3Oy0OwCbmDgE8gOznElRA0Garh5NW2Sp0PqNjjUoRmhyq6mU+Ul48LTWAHAZFqh/x9UCAnjw==

hashcat output running -m 26620:

Session..........: 134659                                 
Status...........: Cracked
Hash.Mode........: 26620 (MetaMask Wallet (needs all data, checks AES-GCM tag))
Hash.Target......: $metamask$600000$xsq1OyKYinxYyiOUWyTVT820oedGQy+smC...Anjw==
Time.Started.....: Tue Nov 25 13:47:25 2025 (2 secs)
Time.Estimated...: Tue Nov 25 13:47:27 2025 (0 secs; Runtime limited: 59 mins, 58 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/cyclone/tmp/134659.wordlist.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:        1 H/s (1.24ms) @ Accel:8 Loops:512 Thr:512 Vec:1
Speed.#2.........:        0 H/s (0.00ms) @ Accel:8 Loops:512 Thr:512 Vec:1
Speed.#*.........:        1 H/s
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:599552-599999
Restore.Sub.#2...: Salt:0 Amplifier:0-0 Iteration:0-512
Candidate.Engine.: Host Generator + PCIe
Candidates.#1....: catanddog -> catanddog
Candidates.#2....: [Copying]
Hardware.Mon.#1..: Temp: 44c Fan: 31% Util: 95% Core:2775MHz Mem:10251MHz Bus:1
Hardware.Mon.#2..: Temp: 44c Fan: 32% Util:  0% Core:2805MHz Mem:10251MHz Bus:1
Started: Tue Nov 25 13:47:21 2025
Stopped: Tue Nov 25 13:47:28 2025

[cyclone]

If you're having issues getting hashcat working with the -m 26620 kernel, make sure you're following the directions on where to place the kernel / module files, then compile hashcat.
hashcat_26620_kernel
https://github.com/cyclone-github/hashcat_26620_kernel

If you're not able to get that working, you can download my hashcat v6.2.6 fork which comes pre-compiled with the -m 26620 kernel.
https://github.com/cyclone-github/hashcat/releases/tag/hashcat-6.2.6_cyclone-24-11-18

[dbgdbg]

Works like a charm, thank you big time. Will try to compile my own version aswell, if any problems appear i shall return to this post.

[cyclone]

You're welcome, and glad you got it figured out.

[chpost]

@cyclone said in Cracking metamask hash:

Keep in mind that hashcat v7.x recently added support for their own metamask wallet hash with dynamic iterations which is not compatible with the widely used 26620 kernel which I released back in March, 2024.

I guess, it is compatible, but hash string should be changed from

$metamask$600000$...$...$...

to

$metamask$rounds=600000$...$...$...

[cyclone]

@chpost It's not compatible as is, but yes, if you reparse the hash like your example, it will work.