4

I've read how to obtain the user's password hash on OSX using sudo defaults read /var/db/dslocal/nodes/Default/users/user.plist ShadowHashData.

However, after giving Terminal "Full Disk Access" on macOS Mojave, I get the following error:

The domain/default pair of (/var/db/dslocal/nodes/Default/users/user.plist, ShadowHashData) does not exist.

However, the ShadowHashData key can be read by plutil and dscl, so why don't defaults work?

Edit:

dscl (works for obtaining user's hash):

nlykkei-mbp:~ nlykkei$ sudo dscl . -read /Users/nlykkei dsAttrTypeNative:ShadowHashData
dsAttrTypeNative:ShadowHashData:
 62706c69 73743030 d2010203 ...

defaults (doesn't work for obtaining user's hash):

sudo defaults read /var/db/dslocal/nodes/Default/users/nlykkei ShadowHashData
2019-08-07 09:16:32.697 defaults[1123:33825] 
The domain/default pair of (/var/db/dslocal/nodes/Default/users/nlykkei, ShadowHashData) does not exist

whoami (user's identity):

nlykkei-mbp:~ nlykkei$ whoami
nlykkei
nlykkei-mbp:~ nlykkei$ id
uid=501(nlykkei) gid=20(staff) groups=20(staff),502(access_bpf),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),701(com.apple.sharepoint.group.1)

uname (OS version):

nlykkei-mbp:~ nlykkei$ uname -a
Darwin nlykkei-mbp 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64

defaults (works without domain argument):

nlykkei-mbp:~ nlykkei$ sudo defaults read | head -n 10
{
    "Apple Global Domain" =     {
        AKLastIDMSEnvironment = 0;
        AppleKeyboardUIMode = 3;
        "com.apple.sound.beep.flash" = 0;
    };
    bluetoothaudiod =     {
    };
    "com.apple.AppleMultitouchMouse" =     {
        MouseButtonDivision = 55;
 ...

1 Answer 1

1

The ‘read’ verb for defaults takes a domain, not a filename, therefore the .plist suffix should be omitted.

sudo defaults read /var/db/dslocal/nodes/Default/users/user ShadowHashData
5
  • Sorry, but that doesn't work for me.
    – Shuzheng
    Aug 6, 2019 at 12:22
  • @Shuzheng What error do you get? Did you replace user with your correct username?
    – grg
    Aug 6, 2019 at 12:31
  • I get the same error as above. Yes, I replaced the username.
    – Shuzheng
    Aug 6, 2019 at 12:34
  • I've added much more elaborate information. Can you spot now, why defaults doesn't work for obtaining hash data?
    – Shuzheng
    Aug 7, 2019 at 7:20
  • any idea ...? :)
    – Shuzheng
    Mar 9, 2020 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .