Where are Mac user account passwords stored?

Question

How can I access the encrypted value of a local user account password in osx? Would it be possible to check against it or even copy it to another account?

Answer 1

I don't know that much about it, but from what I could gather using opensnoop:

login accesses the local directory service (possibly related to some Kerberos stuff -- maybe that's the underlying implementation for the local directory, it reads /Library/Preferences/edu.mit.Kerberos, /etc/krb5.conf, /usr/etc/krb5.conf etc.).

dscl, the directory service command line utility, then cd Local/Default/Users/yourusername, read reveals the usual unixy account-related stuff, plus: GeneratedUID: 1A5EF9B7-4DB6-4C01-919A-xxxxx (don't know the implications, so I censored a little) -- you can also read this UUID via Accounts.prefPane in System Preferences.app.

That matches a filename in /private/var/db/shadow/hash/ also accessed by login!

I guess your best bet is to rename/copy the files with the GeneratedUID name, or change the reference in the directory service.

Included all my "research" to allow you to retrace my steps and allow for refutability.

I don't have the time to trash and restore my user accounts, so you're on your own now. Good luck.

TLDR: Open Accounts.prefPane, check your UUID (right-click your user in the list) and look for a file by that name in /private/var/db/shadow/hash/. Don't know if it works at all. Good luck.

Answer 2

http://DaveGrohl.org/, via http://www.hackmac.org/forum/topic/260-cracking-107-lion-password-hashes/

Where does my Mac keep my password?

For Lion, it's in your user profile. Your user profile is located at /private/var/db/dslocal/nodes/Default/users/myuser.plist. This is a fancy binary XML file that stores info about your user including your encrypted password. Inside the profile, there is a field called 'ShadowHashData' which is just raw bytes of data that look like:

The password hash is the darker text. The first 4 bytes is the salt. The next 64 bytes is the SHA-512 encryted password. BTW, this is just for a fresh install of Lion. The ShadowHashData for Lion Server or Lion with SMB turned on looks a wee different.

You can view the plist in a normal text editor after changing the owner and converting it to XML.

sudo cp /private/var/db/dslocal/nodes/Default/users/$USER.plist ~/Desktop/user.plist
sudo chown $USER ~/Desktop/user.plist
plutil -convert xml1 ~/Desktop/user.plist