Recover Lion Password Hash with RubyCocoa

gistfile1.rb

#!/usr/bin/ruby

require 'openssl'
require 'osx/cocoa'
include OSX

plain_text_pass = 'foobar'
file = 'user.plist'

user_plist = NSDictionary.dictionaryWithContentsOfFile(file)
    
embedded_bplist = NSPropertyListSerialization.objc_send(
  :propertyListFromData, user_plist['ShadowHashData'][0],
  :mutabilityOption, NSPropertyListImmutable,
  :format, nil,
  :errorDescription, nil
  )

recovered_hash = embedded_bplist['SALTED-SHA512'].to_s.gsub(/<|>/,"").split
sugar = recovered_hash.shift
salt = sugar.scan(/../).collect { |byte| byte.hex.chr }
generated_hash = OpenSSL::Digest::SHA512.hexdigest(salt.join + plain_text_pass)
puts generated_hash
puts recovered_hash.join
puts "MATCH!" if generated_hash.eql?(recovered_hash.join)