icloud_tokens_from_disk.py

import base64
import hashlib
import hmac
import plistlib
from pathlib import Path

import keyring
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.padding import PKCS7

users = {}
for file in Path.home().glob("Library/Application Support/iCloud/Accounts/*"):
    if file.is_symlink():
        users[file.name] = file.resolve().name

print("Select a user:")
for i, (email, dsid) in enumerate(users.items()):
    print(f"{i}: {email} ({dsid})")
selection = int(input("Selection: "))

user = list(users.keys())[selection]
dsid = users[user]

key = keyring.get_password("iCloud", dsid)
if key is None:
    raise ValueError("No iCloud key found in keychain")
key = base64.b64decode(key)

encryped_file_path = Path.home() / "Library/Application Support/iCloud/Accounts" / dsid
encryped_file = open(encryped_file_path, "rb").read()

HMAC_KEY = b"t9s\"lx^awe.580Gj%'ld+0LG<#9xa?>vb)-fkwb92[}"

hashed = hmac.new(HMAC_KEY, key, digestmod=hashlib.md5).digest()

cipher = Cipher(algorithms.AES(hashed), modes.CBC(b"\0" * 16))
decryptor = cipher.decryptor()
decrypted_key = decryptor.update(encryped_file) + decryptor.finalize()
unpadder = PKCS7(128).unpadder()
decrypted_key = unpadder.update(decrypted_key) + unpadder.finalize()

print(plistlib.loads(decrypted_key))

Hello, please write to me in telegram if you have an offer @Apple17390