How to get a password hash through terminal in Recovery Mode?

Question

Is it possible to extract a user’s password hash through the terminal in Recovery Mode?

Answer 1

You didn't specify a special macOS version but at least in Sierra it can be done by:

• open Terminal.app in the menubar > Utilities
• get the name of the main system volume with diskutil list (e.g. Macintosh HD)

• enter in Terminal:

  defaults read /Volumes/<volume_name>/var/db/dslocal/nodes/Default/users/<user_name>.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/<volume_name>/usr/bin/xxd -r -p|/Volumes/<volume_name>/usr/bin/plutil -convert xml1 - -o -
  

  Example (with the main system volume name Macintosh HD and the user name user272783):

  defaults read /Volumes/Macintosh\ HD/var/db/dslocal/nodes/Default/users/user272783.plist ShadowHashData|tr -dc 0-9a-f|/Volumes/Macintosh\ HD/usr/bin/xxd -r -p|/Volumes/Macintosh\ HD/usr/bin/plutil -convert xml1 - -o -
  

  If you specify a file name and choose a r/w volume as destination drive, you can write the file to a volume (... -o /Volumes/FlashDrive/user272783.plist)

---

Please check: What type of hash are a Mac's password stored in?