[carlospolop]

Blog URL

https://labs.sra.io/posts/macospasswordcracking

Blog Title

Extracting and Cracking macOS Local Password Hashes

Blog high summary

Documents a post-compromise macOS workflow: with elevated access, sudo dscl . -read /Users/ryleh exposes ShadowHashData instead of a Linux-style /etc/shadow. On Ubuntu, xxd reverses the hex encoding and plistutil converts the binary plist to XML; the SALTED-SHA512-PBKDF2 fields become $ml$ $ $ .

Hashcat mode 7100 cracks the converted value offline. With 133333 PBKDF2 iterations, even multiple 4× NVIDIA 3080 Ti servers need targeted candidate attacks; OneRuleToRuleThemStill, d3adhob0, 500-MB lists, and possibly rockyou are impractical. Impact is recovery of weak or reused passwords, not a CVE or privilege-escalation exploit.

PR changes

• src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md: Added the Linux-side plist conversion variant and clarified which PBKDF2 fields belong in the offline cracking target.
• src/macos-hardening/macos-security-and-privilege-escalation/macos-users.md: Linked local-user documentation to the existing Shadow Passwords section.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The base book covers macOS-side extraction and Hashcat formatting, but not conversion of copied ShadowHashData on Linux. The SRA Labs article supports the conversion and field selection; Hashcat confirms mode 7100 and the format. The repair labels the Linux variant and corrects the source title. The original technical text and examples remain unchanged; static link, reference and diff chec…

Head: 6d36cb905a7327e070a62cbda8d2951f8607e89e

[carlospolop]

merge