You need the following things:
Step 1: Recovering the encryption key for the source keychain
We can't use
SystemKey as is - it contains random bytes that can't be entered into a password dialog or command line. Even better, we need 24 bytes out of the middle of the file - after the magic number that indicates a key file, but before the checksum bytes.
The proper command to get the right hex key is:
hexdump -s 8 -n 24 -e '1/1 "%.2x"' /path/to/SystemKey && echo
Explained: Skip the first 8 bytes from the beginning of the file, continue 24 bytes after that, and use the format string to dump the data out on one line (it's a C-style
printf string, if you're curious).
&& echo is so we get a single newline afterward so the output doesn't run into the beginning of your shell prompt after the command finishes.
Copy this string aside. This is the decryption key for the keychain.
Step 2: Dump the keychain using the password
We need a third party tool for this. We're going on the assumption that the dead Mac can't be booted in such a way that we can use its Keychain Access app normally.
That tool will be Chainbreaker - a python script. You'll need to install the
hexdump library for Python. Run the following commands on the target machine:
sudo pip install hexdump
git clone https://github.com/n0fate/chainbreaker
Now we simply give chainbreaker the key you just found and the file:
python chainbreaker.py -f /path/to/system.keychain -k (the byte string from step 1)
You'll see the plaintext password of everything in the system keychain. For my use case, I wanted the Time Machine password, and this will be represented in the output as a
Generic password record named
Time Machine. The plaintext password will be below.
Now we can simply use the Finder to open the Time Machine .sparsebundle, give the password we dug out of the keyfile, and continue as usual.