Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I access the encrypted value of a local user account password in osx? Would it be possible to check against it or even copy it to another account?

share|improve this question

The hashes were in /var/db/shadow/hash/ in 10.6 and earlier, but they are stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8.

You can print the hash data with DaveGrohl (sudo dave -s $USER) or something like this:

sudo defaults read /var/db/dslocal/nodes/Default/users/$USER.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

If automatic login is enabled, the password of the login keychain is also stored in /etc/kcpassword encrypted with XOR cipher.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31];"/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'

share|improve this answer
Brillant, how do you learn such an intimate knowledge of OS X? – Edgar Aroutiounian Apr 26 '14 at 18:29
This is not quite right. The "break" should only happen when (b == key[i% key.size]), but I found your code enlightening. Thanks! – Kayvan Sylvan Nov 25 '15 at 0:51

I don't know that much about it, but from what I could gather using opensnoop:

login accesses the local directory service (possibly related to some Kerberos stuff -- maybe that's the underlying implementation for the local directory, it reads /Library/Preferences/, /etc/krb5.conf, /usr/etc/krb5.conf etc.).

dscl, the directory service command line utility, then cd Local/Default/Users/yourusername, read reveals the usual unixy account-related stuff, plus: GeneratedUID: 1A5EF9B7-4DB6-4C01-919A-xxxxx (don't know the implications, so I censored a little) -- you can also read this UUID via Accounts.prefPane in System

That matches a filename in /private/var/db/shadow/hash/ also accessed by login!

I guess your best bet is to rename/copy the files with the GeneratedUID name, or change the reference in the directory service.

Included all my "research" to allow you to retrace my steps and allow for refutability.

I don't have the time to trash and restore my user accounts, so you're on your own now. Good luck.

TLDR: Open Accounts.prefPane, check your UUID (right-click your user in the list) and look for a file by that name in /private/var/db/shadow/hash/. Don't know if it works at all. Good luck.

share|improve this answer
To expand on my answer, /private/var/db/shadow/hash/ really contains the password hashes (not like encrypted passwords, there's no way to restore them directly). Also see here and here. – Daniel Beck Oct 9 '10 at 9:05
I love googling for obscure system directories to find out what they're for :-) – Daniel Beck Oct 9 '10 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .