v0.1.5

Phantom Vault Decryptor

POC tool to decrypt Phantom vaults

This toolset is proudly the first publicly released Phantom Vault Decryptor

Writeup of my process of decrypting Phantom Wallets and recovering the seed phrase

• https://github.com/cyclone-github/writeups/blob/main/Pwning%20Phantom%20Wallets.pdf

Decryptor usage example:

 ----------------------------------------------- 
|       Cyclone's Phantom Vault Decryptor       |
| https://github.com/cyclone-github/phantom_pwn |
 ----------------------------------------------- 

Vault file:     hash.txt
Valid Vaults:   1
CPU Threads:    16
Wordlist:       wordlist.txt
2024/11/30 14:11:35 Working...
{"encryptedKey":{"digest":"sha256","encrypted":"5pLvA3bCjNGYBbSjjFY3mdPknwFfp3cz9dCBv6izyyrqEhYCBkKwo3zZUzBP44KtY3","iterations":10000,"kdf":"pbkdf2","nonce":"NZT6kw5Cd5VeZu5yJGJcFcP24tnmg4xsR","salt":"A43vTZnm9c5CiQ6FLTdV9v"},"version":1}:password
2024/11/30 14:11:39 Decrypted: 1/1 6181.36 h/s 00h:00m:03s

2024/11/30 14:11:39 Finished

Decryptor supported options:

-w {wordlist} (omit -w to read from stdin)
-h {phantom_wallet_hash}
-o {output} (omit -o to write to stdout)
-t {cpu threads}
-s {print status every nth sec}

-version (version info)
-help (usage instructions)

./phantom_decryptor.bin -h {phantom_wallet_hash} -w {wordlist} -o {output} -t {cpu threads} -s {print status every nth sec}

./phantom_decryptor.bin -h phantom.txt -w wordlist.txt -o cracked.txt -t 16 -s 10

cat wordlist | ./phantom_decryptor.bin -h phantom.txt

./phantom_decryptor.bin -h phantom.txt -w wordlist.txt -o output.txt

Changelog:

v0.1.5-2024-11-30-1415;
	fix https://github.com/cyclone-github/phantom_pwn/issues/6
	swapped crackedCount and lineProcessed channels for atomic int32 for better performance
	multiple performance optimizations in process.go
	print vault:password when vault is cracked

Checksum:

2b15f7705092dad90bb4ea454f91744de3dbaec59f8b259278913c1a56c75019  phantom_decryptor_amd64.bin
b8816b94f18061f81018d5b346eec8ddc7609778b7e5ba3f5939d357db2b9edd  phantom_decryptor_amd64-darwin
6d849d5a36c7aef1ab68579f61035b2c714e1db4c09fa0bd6845705224c5a34e  phantom_decryptor_amd64.exe

Jotti Antivirus Scan Results:

https://virusscan.jotti.org/en-US/filescanjob/dcfuoi2ecx,zcx5eurogb,ybul8xq8zo