Toolset to extract and decrypt metamask vaults (wallets)

• Contact me at https://forum.hashpwn.net/user/cyclone if you need help recovering your Metamask wallet password or seed phrase

Tool to extract metamask vaults to JSON and hashcat compatible formats

• Metamask JSON vaults can be decrypted with https://github.com/cyclone-github/metamask_pwn
• Previous Metamask hashes can be cracked using hashcat -m 26600
• New Metamask hashes can be cracked with hashcat using my custom -m 26620 kernel below
  • https://github.com/cyclone-github/hashcat_26620_kernel
• Note: metamask_extractor supports hashcat mode 26620 for convenience, but this is a third-party module written by cyclone that is not affiliated with or included in the official hashcat beta or release builds at https://github.com/hashcat/hashcat

• Linux: /home/$USER/.config/google-chrome/Default/Local\ Extension\ Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/
• Mac: Library>Application Support>Google>Chrome>Default>Local Extension Settings>nkbihfbeogaeaoehlefnkodbefgpgknn
• Windows C:\Users\$USER\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn

• Linux: ./metamask_extractor.bin {metamask_vault_dir}
• Windows: metamask_extractor.exe {metamask_vault_dir}

• If you want the latest features, compiling from source is the best option since the release version may run several revisions behind the source code.
• This assumes you have Go and Git installed
  • git clone https://github.com/cyclone-github/metamask_pwn.git # clone repo
  • cd metamask_pwn/metamask_extractor # enter project directory
  • go mod init metamask_extractor # initialize Go module (skips if go.mod exists)
  • go mod tidy # download dependencies
  • go build -ldflags="-s -w" . # compile binary in current directory
  • go install -ldflags="-s -w" . # compile binary and install to $GOPATH
• Compile from source code how-to:
  • https://github.com/cyclone-github/scripts/blob/main/intro_to_go.txt

This tool is proudly the first publicly released Metamask Vault decryptor / cracker to support the new Metamask wallet vaults which have a dynamic iteration.

./metamask_decryptor_amd64.bin -h metamask_json.txt -w wordlist.txt
 ------------------------------------ 
| Cyclone's Metamask Vault Decryptor |
 ------------------------------------ 

Vault file:     metamask_json.txt
Valid Vaults:   1
CPU Threads:    16
Wordlist:       wordlist.txt
Working...

Decrypted: 0/1  5430.89 h/s     00h:01m:00s

• Supports previous Metamask vaults as well as new vaults with "KeyMetadata" which have dynamic iterations
• If you need help extracting Metamask vaults, use Metamask Extractor https://github.com/cyclone-github/metamask_pwn
• Metamask Vault Decryptor is superseded by hashcat, however, Metamask Vault Decryptor also displays the seed phrase alongside the vault password, which hashcat does not currently support

• Old vault format: {"data": "","iv": "","salt": ""}
• New vault format: {"data": "","iv": "","keyMetadata": {"algorithm": "PBKDF2","params": {"iterations": }},"salt": ""}

• ./metamask_decryptor.bin -h {wallet_json} -w {wordlist}

If the tool successfully decrypts the vault, tool will print the vault json, seed phrase and vault password

Decrypted Vault: '{}'
Seed Phrase:    ''
Vault Password: ''

go install github.com/cyclone-github/metamask_pwn/metamask_extractor@main

go install github.com/cyclone-github/metamask_pwn/metamask_decryptor@main

• If you want the latest features, compiling from source is the best option since the release version may run several revisions behind the source code.
• This assumes you have Go and Git installed
  • git clone https://github.com/cyclone-github/metamask_pwn.git # clone repo
  • cd metamask_pwn/metamask_decryptor # enter project directory
  • go mod init metamask_decryptor # initialize Go module (skips if go.mod exists)
  • go mod tidy # download dependencies
  • go build -ldflags="-s -w" . # compile binary in current directory
  • go install -ldflags="-s -w" . # compile binary and install to $GOPATH
• Compile from source code how-to:
  • https://github.com/cyclone-github/scripts/blob/main/intro_to_go.txt