How to use the command line to list password files on a Macintosh machine.

Posted: March 15, 2014. At: 9:41 PM. This was 4 years ago. Post ID: 7064
Page permalink.
WordPress uses cookies, or tiny pieces of information stored on your computer, to verify who you are. There are cookies for logged in users and for commenters. These cookies expire two weeks after they are set.

This is how to list the password files on a Macintosh OSX Mountain Lion machine. Newer Macintosh OSX machines do not use the /etc/shadow file link Linux does, so this is how the account passwords are stored.

Homers-iMac:~ homer$ sudo ls -lah /var/db/dslocal/nodes/Default/users/
Password:
total 336
drwx------ 74 root wheel 2.5K 14 Mar 10:13 .
drw------- 11 root wheel 374B 14 Mar 10:11 ..
[email protected] 1 root wheel 260B 21 Jun 2012 _amavisd.plist
[email protected] 1 root wheel 254B 21 Jun 2012 _appleevents.plist
[email protected] 1 root wheel 261B 14 Mar 09:39 _appowner.plist
[email protected] 1 root wheel 276B 14 Mar 09:39 _appserver.plist
[email protected] 1 root wheel 248B 21 Jun 2012 _ard.plist
[email protected] 1 root wheel 254B 14 Mar 09:39 _atsserver.plist
[email protected] 1 root wheel 266B 14 Mar 09:39 _avbdeviced.plist
[email protected] 1 root wheel 250B 14 Mar 09:39 _calendar.plist
[email protected] 1 root wheel 258B 14 Mar 09:39 _ces.plist
[email protected] 1 root wheel 258B 21 Jun 2012 _clamav.plist
[email protected] 1 root wheel 253B 21 Jun 2012 _coreaudiod.plist
[email protected] 1 root wheel 241B 14 Mar 09:39 _cvmsroot.plist
[email protected] 1 root wheel 236B 21 Jun 2012 _cvs.plist
[email protected] 1 root wheel 263B 21 Jun 2012 _cyrus.plist
[email protected] 1 root wheel 265B 14 Mar 09:39 _devdocs.plist
[email protected] 1 root wheel 259B 14 Mar 09:39 _devicemgr.plist
[email protected] 1 root wheel 257B 21 Jun 2012 _dovecot.plist
[email protected] 1 root wheel 256B 21 Jun 2012 _dovenull.plist
[email protected] 1 root wheel 239B 14 Mar 09:39 _dpaudio.plist
[email protected] 1 root wheel 253B 21 Jun 2012 _eppc.plist
[email protected] 1 root wheel 246B 14 Mar 09:39 _ftp.plist
[email protected] 1 root wheel 248B 14 Mar 09:39 _geod.plist
[email protected] 1 root wheel 260B 14 Mar 09:39 _installassistant.plist
[email protected] 1 root wheel 245B 14 Mar 09:39 _installer.plist
[email protected] 1 root wheel 271B 14 Mar 09:39 _jabber.plist
[email protected] 1 root wheel 264B 14 Mar 09:39 _kadmin_admin.plist
[email protected] 1 root wheel 279B 21 Jun 2012 _kadmin_changepw.plist
[email protected] 1 root wheel 276B 21 Jun 2012 _krb_anonymous.plist
[email protected] 1 root wheel 289B 21 Jun 2012 _krb_changepw.plist
[email protected] 1 root wheel 277B 14 Mar 09:39 _krb_kadmin.plist
[email protected] 1 root wheel 265B 14 Mar 09:39 _krb_kerberos.plist
[email protected] 1 root wheel 286B 21 Jun 2012 _krb_krbtgt.plist
-rw------- 1 root wheel 666B 14 Mar 10:11 _krbtgt.plist
[email protected] 1 root wheel 249B 21 Jun 2012 _lda.plist
[email protected] 1 root wheel 259B 21 Jun 2012 _locationd.plist
[email protected] 1 root wheel 256B 21 Jun 2012 _lp.plist
[email protected] 1 root wheel 261B 21 Jun 2012 _mailman.plist
[email protected] 1 root wheel 251B 21 Jun 2012 _mcxalr.plist
[email protected] 1 root wheel 249B 21 Jun 2012 _mdnsresponder.plist
[email protected] 1 root wheel 248B 14 Mar 09:39 _mysql.plist
[email protected] 1 root wheel 238B 21 Jun 2012 _netbios.plist
[email protected] 1 root wheel 264B 21 Jun 2012 _netstatistics.plist
[email protected] 1 root wheel 249B 21 Jun 2012 _networkd.plist
[email protected] 1 root wheel 271B 14 Mar 09:39 _postfix.plist
[email protected] 1 root wheel 251B 14 Mar 09:39 _postgres.plist
[email protected] 1 root wheel 262B 14 Mar 09:39 _qtss.plist
[email protected] 1 root wheel 248B 14 Mar 09:39 _sandbox.plist
[email protected] 1 root wheel 246B 14 Mar 09:39 _screensaver.plist
[email protected] 1 root wheel 258B 14 Mar 09:39 _scsd.plist
[email protected] 1 root wheel 265B 21 Jun 2012 _securityagent.plist
[email protected] 1 root wheel 274B 21 Jun 2012 _serialnumberd.plist
[email protected] 1 root wheel 265B 21 Jun 2012 _softwareupdate.plist
[email protected] 1 root wheel 253B 14 Mar 09:39 _spotlight.plist
[email protected] 1 root wheel 261B 21 Jun 2012 _sshd.plist
[email protected] 1 root wheel 236B 14 Mar 09:39 _svn.plist
[email protected] 1 root wheel 250B 14 Mar 09:39 _taskgated.plist
[email protected] 1 root wheel 267B 14 Mar 09:39 _teamsserver.plist
[email protected] 1 root wheel 252B 14 Mar 09:39 _timezone.plist
[email protected] 1 root wheel 250B 21 Jun 2012 _tokend.plist
[email protected] 1 root wheel 270B 14 Mar 09:39 _trustevaluationagent.plist
[email protected] 1 root wheel 252B 14 Mar 09:39 _unknown.plist
[email protected] 1 root wheel 257B 14 Mar 09:39 _update_sharing.plist
[email protected] 1 root wheel 264B 14 Mar 09:39 _usbmuxd.plist
[email protected] 1 root wheel 265B 21 Jun 2012 _uucp.plist
[email protected] 1 root wheel 240B 14 Mar 09:39 _warmd.plist
[email protected] 1 root wheel 254B 14 Mar 09:39 _webauthserver.plist
[email protected] 1 root wheel 262B 21 Jun 2012 _windowserver.plist
[email protected] 1 root wheel 265B 14 Mar 09:39 _www.plist
[email protected] 1 root wheel 243B 21 Jun 2012 daemon.plist
-rw------- 1 root wheel 161K 14 Mar 10:13 homer.plist
[email protected] 1 root wheel 266B 14 Mar 09:39 nobody.plist
[email protected] 1 root wheel 288B 14 Mar 09:39 root.plist

This lists all of the accounts on the machine. This allows you to get hold of a password file to attack.

There is a tutorial here, this lists the steps required to crack a Macintosh Mountain Lion password file. This requires Administrator access on a Macintosh machine.

No comments have been made. Use this form to start the conversation :)

Leave a Reply