1

Is it possible to extract a user’s password hash through the terminal in Recovery Mode?

1
  • For what reason?
    – Harcker
    Commented Jan 18, 2018 at 18:52

1 Answer 1

1

You didn't specify a special macOS version but at least in Sierra it can be done by:

  • open Terminal.app in the menubar > Utilities
  • get the name of the main system volume with diskutil list (e.g. Macintosh HD)
  • enter in Terminal:

    defaults read /Volumes/<volume_name>/var/db/dslocal/nodes/Default/users/<user_name>.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/<volume_name>/usr/bin/xxd -r -p|/Volumes/<volume_name>/usr/bin/plutil -convert xml1 - -o -
    

    Example (with the main system volume name Macintosh HD and the user name user272783):

    defaults read /Volumes/Macintosh\ HD/var/db/dslocal/nodes/Default/users/user272783.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/Macintosh\ HD/usr/bin/xxd -r -p|/Volumes/Macintosh\ HD/usr/bin/plutil -convert xml1 - -o -
    

    If you specify a file name and choose a r/w volume as destination drive, you can write the file to a volume (... -o /Volumes/FlashDrive/user272783.plist)


Please check: What type of hash are a Mac's password stored in?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .