Is it possible to extract a user’s password hash through the terminal in Recovery Mode?
1 Answer
You didn't specify a special macOS version but at least in Sierra it can be done by:
- open Terminal.app in the menubar > Utilities
- get the name of the main system volume with
diskutil list
(e.g. Macintosh HD) enter in Terminal:
defaults read /Volumes/<volume_name>/var/db/dslocal/nodes/Default/users/<user_name>.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/<volume_name>/usr/bin/xxd -r -p|/Volumes/<volume_name>/usr/bin/plutil -convert xml1 - -o -
Example (with the main system volume name Macintosh HD and the user name user272783):
defaults read /Volumes/Macintosh\ HD/var/db/dslocal/nodes/Default/users/user272783.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/Macintosh\ HD/usr/bin/xxd -r -p|/Volumes/Macintosh\ HD/usr/bin/plutil -convert xml1 - -o -
If you specify a file name and choose a r/w volume as destination drive, you can write the file to a volume (
... -o /Volumes/FlashDrive/user272783.plist
)
Please check: What type of hash are a Mac's password stored in?