How to use the command line to list password files on a Macintosh machine.

Posted: March 15, 2014. At: 9:41 PM. This was 3 years ago. Post ID: 7064

This is how to list the password files on a Macintosh OSX Mountain Lion machine. Newer Macintosh OSX machines do not use the /etc/shadow file link Linux does, so this is how the account passwords are stored.

Homers-iMac:~ homer$ sudo ls -lah /var/db/dslocal/nodes/Default/users/
Password:
total 336
drwx------ 74 root wheel 2.5K 14 Mar 10:13 .
drw------- 11 root wheel 374B 14 Mar 10:11 ..
-rw-------@ 1 root wheel 260B 21 Jun 2012 _amavisd.plist
-rw-------@ 1 root wheel 254B 21 Jun 2012 _appleevents.plist
-rw-------@ 1 root wheel 261B 14 Mar 09:39 _appowner.plist
-rw-------@ 1 root wheel 276B 14 Mar 09:39 _appserver.plist
-rw-------@ 1 root wheel 248B 21 Jun 2012 _ard.plist
-rw-------@ 1 root wheel 254B 14 Mar 09:39 _atsserver.plist
-rw-------@ 1 root wheel 266B 14 Mar 09:39 _avbdeviced.plist
-rw-------@ 1 root wheel 250B 14 Mar 09:39 _calendar.plist
-rw-------@ 1 root wheel 258B 14 Mar 09:39 _ces.plist
-rw-------@ 1 root wheel 258B 21 Jun 2012 _clamav.plist
-rw-------@ 1 root wheel 253B 21 Jun 2012 _coreaudiod.plist
-rw-------@ 1 root wheel 241B 14 Mar 09:39 _cvmsroot.plist
-rw-------@ 1 root wheel 236B 21 Jun 2012 _cvs.plist
-rw-------@ 1 root wheel 263B 21 Jun 2012 _cyrus.plist
-rw-------@ 1 root wheel 265B 14 Mar 09:39 _devdocs.plist
-rw-------@ 1 root wheel 259B 14 Mar 09:39 _devicemgr.plist
-rw-------@ 1 root wheel 257B 21 Jun 2012 _dovecot.plist
-rw-------@ 1 root wheel 256B 21 Jun 2012 _dovenull.plist
-rw-------@ 1 root wheel 239B 14 Mar 09:39 _dpaudio.plist
-rw-------@ 1 root wheel 253B 21 Jun 2012 _eppc.plist
-rw-------@ 1 root wheel 246B 14 Mar 09:39 _ftp.plist
-rw-------@ 1 root wheel 248B 14 Mar 09:39 _geod.plist
-rw-------@ 1 root wheel 260B 14 Mar 09:39 _installassistant.plist
-rw-------@ 1 root wheel 245B 14 Mar 09:39 _installer.plist
-rw-------@ 1 root wheel 271B 14 Mar 09:39 _jabber.plist
-rw-------@ 1 root wheel 264B 14 Mar 09:39 _kadmin_admin.plist
-rw-------@ 1 root wheel 279B 21 Jun 2012 _kadmin_changepw.plist
-rw-------@ 1 root wheel 276B 21 Jun 2012 _krb_anonymous.plist
-rw-------@ 1 root wheel 289B 21 Jun 2012 _krb_changepw.plist
-rw-------@ 1 root wheel 277B 14 Mar 09:39 _krb_kadmin.plist
-rw-------@ 1 root wheel 265B 14 Mar 09:39 _krb_kerberos.plist
-rw-------@ 1 root wheel 286B 21 Jun 2012 _krb_krbtgt.plist
-rw------- 1 root wheel 666B 14 Mar 10:11 _krbtgt.plist
-rw-------@ 1 root wheel 249B 21 Jun 2012 _lda.plist
-rw-------@ 1 root wheel 259B 21 Jun 2012 _locationd.plist
-rw-------@ 1 root wheel 256B 21 Jun 2012 _lp.plist
-rw-------@ 1 root wheel 261B 21 Jun 2012 _mailman.plist
-rw-------@ 1 root wheel 251B 21 Jun 2012 _mcxalr.plist
-rw-------@ 1 root wheel 249B 21 Jun 2012 _mdnsresponder.plist
-rw-------@ 1 root wheel 248B 14 Mar 09:39 _mysql.plist
-rw-------@ 1 root wheel 238B 21 Jun 2012 _netbios.plist
-rw-------@ 1 root wheel 264B 21 Jun 2012 _netstatistics.plist
-rw-------@ 1 root wheel 249B 21 Jun 2012 _networkd.plist
-rw-------@ 1 root wheel 271B 14 Mar 09:39 _postfix.plist
-rw-------@ 1 root wheel 251B 14 Mar 09:39 _postgres.plist
-rw-------@ 1 root wheel 262B 14 Mar 09:39 _qtss.plist
-rw-------@ 1 root wheel 248B 14 Mar 09:39 _sandbox.plist
-rw-------@ 1 root wheel 246B 14 Mar 09:39 _screensaver.plist
-rw-------@ 1 root wheel 258B 14 Mar 09:39 _scsd.plist
-rw-------@ 1 root wheel 265B 21 Jun 2012 _securityagent.plist
-rw-------@ 1 root wheel 274B 21 Jun 2012 _serialnumberd.plist
-rw-------@ 1 root wheel 265B 21 Jun 2012 _softwareupdate.plist
-rw-------@ 1 root wheel 253B 14 Mar 09:39 _spotlight.plist
-rw-------@ 1 root wheel 261B 21 Jun 2012 _sshd.plist
-rw-------@ 1 root wheel 236B 14 Mar 09:39 _svn.plist
-rw-------@ 1 root wheel 250B 14 Mar 09:39 _taskgated.plist
-rw-------@ 1 root wheel 267B 14 Mar 09:39 _teamsserver.plist
-rw-------@ 1 root wheel 252B 14 Mar 09:39 _timezone.plist
-rw-------@ 1 root wheel 250B 21 Jun 2012 _tokend.plist
-rw-------@ 1 root wheel 270B 14 Mar 09:39 _trustevaluationagent.plist
-rw-------@ 1 root wheel 252B 14 Mar 09:39 _unknown.plist
-rw-------@ 1 root wheel 257B 14 Mar 09:39 _update_sharing.plist
-rw-------@ 1 root wheel 264B 14 Mar 09:39 _usbmuxd.plist
-rw-------@ 1 root wheel 265B 21 Jun 2012 _uucp.plist
-rw-------@ 1 root wheel 240B 14 Mar 09:39 _warmd.plist
-rw-------@ 1 root wheel 254B 14 Mar 09:39 _webauthserver.plist
-rw-------@ 1 root wheel 262B 21 Jun 2012 _windowserver.plist
-rw-------@ 1 root wheel 265B 14 Mar 09:39 _www.plist
-rw-------@ 1 root wheel 243B 21 Jun 2012 daemon.plist
-rw------- 1 root wheel 161K 14 Mar 10:13 homer.plist
-rw-------@ 1 root wheel 266B 14 Mar 09:39 nobody.plist
-rw-------@ 1 root wheel 288B 14 Mar 09:39 root.plist

This lists all of the accounts on the machine. This allows you to get hold of a password file to attack.

There is a tutorial here, this lists the steps required to crack a Macintosh Mountain Lion password file. This requires Administrator access on a Macintosh machine.

No comments have been made. Use this form to start the conversation :)

Leave a Reply