Skip to content

Instantly share code, notes, and snippets.

@ambalabanov
ambalabanov / ShadowHashData.sh
Last active January 14, 2021 10:18
Dump shadow on macOS Catalina
#!/bin/bash
USER=$1
SHADOW_HASH_DATA=$(dscl -plist . -read /Users/$USER ShadowHashData | xpath 'plist[@version="1.0"]/dict//array/string/text()' 2>/dev/null | tr -cd '[:print:]' | xxd -r -p | base64)
echo '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData' > $USER.dsimport
echo -n $USER:$SHADOW_HASH_DATA >> $USER.dsimport
entropy=$(echo $SHADOW_HASH_DATA | base64 -D | plutil -convert xml1 - -o - | plutil -extract 'SALTED-SHA512-PBKDF2' xml1 - -o - | plutil -extract 'entropy' xml1 - -o - | xpath 'plist[@version="1.0"]/data/text()' 2>/dev/null | tr -cd '[:print:]' | base64 -D | xxd -p | tr -d '\n')
salt=$(echo $SHADOW_HASH_DATA | base64 -D | plutil -convert xml1 - -o - | plutil -extract 'SALTED-SHA512-PBKDF2' xml1 - -o - | plutil -extract 'salt' xml1 - -o - | xpath 'plist[@version="1.0"]/data/text()' 2>/dev/null | tr -cd '[:print:]' | base64 -D | xxd -p | tr -d '\n')
iterations=$(echo $SHADOW_HASH_DATA | base64 -D | plutil -convert xml1 - -o - | p
#/bin/bash
for p in linux-compiler-gcc-9-x86_5.7.6-1kali2_amd64.deb linux-kbuild-5.7_5.7.6-1kali2_amd64.deb linux-headers-5.7.0-kali1-common_5.7.6-1kali2_all.deb linux-headers-5.7.0-kali1-amd64_5.7.6-1kali2_amd64.deb
do
wget http://http.kali.org/kali/pool/main/l/linux/$p
sudo dpkg -i $p
done
sudo apt-mark hold linux-image-amd64 linux-headers-amd64
@ambalabanov
ambalabanov / .bashrc
Last active February 10, 2026 23:37
metasploit docker-compose
# .bashrc
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=
@ambalabanov
ambalabanov / arch-base-install.sh
Created November 2, 2021 04:38
arch-base-install.sh
#!/usr/bin/env bash
# stop on errors
set -eu
# variables
DISK='/dev/sda'
FQDN='arch.local'
TIMEZONE='Asia/Yekaterinburg'
TARGET_DIR='/mnt'