15

I think on previous versions of OS X, password were stored in the /etc/shadow file.

Nevertheless, this file doesn't appear to exist in the later versions of the operating system - specifically OS X 10.9 which is the first of the non-cat named OS releases.

Does anyone know where the password hashes are stored on OS X Mavericks?

Improve this question

3 Answers 3

Reset to default
22

Starting with Lion, OS X introduced a shadow file per user that is a plist dictionary that contains password hashes and other GID/UID/kerberos and open directory type keys.

The shadow files are stored on the filesystem at /var/db/dslocal/nodes/Default/users. They are in plist format so you'll need to use the plutil command to view them or use the defaults command to extract/write specific keys if desired. Only the root user has access to the files.

To view the contents of a shadow file for a user:

sudo plutil -p /var/db/dslocal/nodes/Default/users/<username>.plist

To get the hash:

sudo defaults read /var/db/dslocal/nodes/Default/users/<username>.plist ShadowHashData|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o -

Where <username> in the above examples is the user you're looking for the hash for. You want the <data> section that corresponds to the <key>entropy</key> key in that plist output.

To continue on to try and crack the password see this tutorial.

Improve this answer
7
  • 3
    This is not working for me: it says that ShadowHashData is not a valid property in <username>.plist...
    – Maxwell Zhao
    Commented Mar 12, 2016 at 4:09
  • @MarkWright what OS X version? Works great for me on 10.11.3. Are you using LDAP for the accounts or is it a local account?
    – Ian C.
    Commented Mar 12, 2016 at 18:19
  • I am using 10.9 on single user mode.
    – Maxwell Zhao
    Commented Mar 12, 2016 at 19:14
  • What does sudo defaults read /var/db/dslocal/nodes/Default/users/${USER}.plist show for you?
    – Ian C.
    Commented Mar 13, 2016 at 1:13
  • 1
    sudo plutil -p still seems to work in 10.14, even with SIP enabled.
    – nohillside ♦
    Commented Apr 21, 2020 at 8:05
3

I want to add to the accepted answer, just in case someone tries to get the password hashes stored on an OS X Server in Open Directory. For network (OD) users you need to

sudo mkpassdb -dump

which will get you a list of users and their respective slot IDs. Copy the entire slot ID beginning with 0x and issue

sudo mkpassdb -dump slot_id_that_you_retrieved

You'll see several digest entries, amongst which *cmusaslsecretSMBNT is the NTLM password hash and *cmusaslsecretDIGEST-MD5 is the regular MD5 hash. Do with those what you wish, but I found it easier to submit those to https://hashkiller.co.uk/ntlm-decrypter.aspx which is a free online hash cracking service. It accepts your hash and if not yet in their database will start working on it. Return a week later and it should be cracked. This has been tested on OS X El Capitan and Mac OS Sierra. You may not see digests if some auth methods have been explicitly disabled on your server but they should be there by default.

Improve this answer
-2

I looked it up on Google and found this: http://hackmac.org/forum/topic/2678-ceacking-os-x-mountain-lion-os-x-mavericks-os-x-yosemite-account-password

Improve this answer
1
  • 3
    The link is broken. Also note that link-only answers without explanation are frowned upon.
    – intcreator
    Commented Nov 10, 2017 at 4:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .