Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I access the encrypted value of a local user account password in osx? Would it be possible to check against it or even copy it to another account?

share|improve this question

2 Answers 2

I don't know that much about it, but from what I could gather using opensnoop:

login accesses the local directory service (possibly related to some Kerberos stuff -- maybe that's the underlying implementation for the local directory, it reads /Library/Preferences/edu.mit.Kerberos, /etc/krb5.conf, /usr/etc/krb5.conf etc.).

dscl, the directory service command line utility, then cd Local/Default/Users/yourusername, read reveals the usual unixy account-related stuff, plus: GeneratedUID: 1A5EF9B7-4DB6-4C01-919A-xxxxx (don't know the implications, so I censored a little) -- you can also read this UUID via Accounts.prefPane in System Preferences.app.

That matches a filename in /private/var/db/shadow/hash/ also accessed by login!

I guess your best bet is to rename/copy the files with the GeneratedUID name, or change the reference in the directory service.

Included all my "research" to allow you to retrace my steps and allow for refutability.

I don't have the time to trash and restore my user accounts, so you're on your own now. Good luck.

TLDR: Open Accounts.prefPane, check your UUID (right-click your user in the list) and look for a file by that name in /private/var/db/shadow/hash/. Don't know if it works at all. Good luck.

share|improve this answer
    
To expand on my answer, /private/var/db/shadow/hash/ really contains the password hashes (not like encrypted passwords, there's no way to restore them directly). Also see here and here. –  Daniel Beck Oct 9 '10 at 9:05
1  
I love googling for obscure system directories to find out what they're for :-) –  Daniel Beck Oct 9 '10 at 9:05

The hashes were in /var/db/shadow/hash/ in 10.6 and earlier, but they are stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8.

You can print the hash data with DaveGrohl (sudo dave -s $USER) or something like this:

sudo defaults read /var/db/dslocal/nodes/Default/users/$USER.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

If automatic login is enabled, the password of the login keychain is also stored in /etc/kcpassword encrypted with XOR cipher.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'

share|improve this answer
    
Brillant, how do you learn such an intimate knowledge of OS X? –  Edgar Aroutiounian Apr 26 at 18:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.