0

This question already has an answer here:

I am playing about with 'John the ripper' to see how easily my password can be cracked. The only issue i I cannot seem to fin the hashed password.

Things I've tried.

  • Reading hash from /etc/passwd - Result: No user found
  • sudo dscl . -read /Users/<user>/ | grep GeneratedUID | cut -c15- cat /var/db/shadow/hash/<Result From First Command> | cut -c169-216 - Result: directory 'shadow' does not exist
  • Some others (forgotten what they were. Had similar issues.

This also didn't work for me.

Would like to know where the password hash is for my user so I can test out JTR.
Thanks in advanced.

Edit:

When I do sudo defaults read /var/db/dslocal/nodes/Default/users/Test.plist ShadowHashData|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o - I get 2 hashes'zcvUSru/AH3YNusqitC14z8dm8iX9dZTRzKKkv+oMODQQ9CG79yGmsjo8s13UCSIZ6TmE/U2krMC7KzxgafDwVkOq0eJ1F6aYFUBex649rUnj/58jhCp7Lgt5vWYN95SrDQwMKEYkFXkHM/Ieg0GsnCJnZwem4ugfSnU2fKCquE= and weXOBzKgCTzoeamwRXZ8vLNQNrHyCyFk/ZD2Bc/Vb6c= However when I put 'Test:' in a text file and do ./john <file> It gives me 'No password hashes loaded'.

Is this an issue with how I'm using John The Ripper or am I getting the wrong hashes?

Note: This was a test user and this is not my real password hashed. The encrypted password is 'password'

marked as duplicate by Nimesh Neema, nohillside macos Jun 25 at 18:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • The link you mentioned worked fine for me on a Yosemite system - I assume you replaced <username> with the correct username for the user in question? – mjturner Aug 6 '15 at 13:59
  • @mjturner That doesn't work for me. Look at my edit for more info. – iProgram Aug 6 '15 at 18:53
  • Which version of John the Ripper are you running? Not all versions support 10.7 and later salted SHA-512 hashes... See the documentation for more information - you need a -jumbo edition. – mjturner Aug 6 '15 at 21:18
  • @mjturner What do you mean a jumbo edition? Do you have to pay for it? I will tell you my version when I next get a chance. – iProgram Aug 6 '15 at 22:10
  • The -jumbo editions are community-supported editions that add additional features. If you check the list of downloads you will see them listed there. No, you don't have to pay for such releases - they're open source. – mjturner Aug 7 '15 at 7:28

Browse other questions tagged .