MacOS High Sierra密码哈希存储位置咨询（Python工具开发）

Hey there! Great to hear your Python automation tool is coming along nicely—let's get that hash retrieval sorted out for MacOS High Sierra.

Where Password Hashes Live in MacOS High Sierra #

MacOS shifted how it stores user credentials around the Sierra/High Sierra era, so here's the breakdown of the key locations:

• Local User Accounts: The primary spot is /var/db/dslocal/nodes/Default/users/[your-username].plist. Inside this binary plist file, look for the ShadowHashData field—it holds the encrypted password hashes (typically using PBKDF2 with SHA-512). This directory is locked down to root access only, so you'll need to use sudo to read or interact with these files.
• Legacy/System Accounts: You might find some older or system-level account hashes in /etc/shadow, but this is mostly for backward compatibility now. The modern, active hashes are almost always in the dslocal plist files mentioned above.

Quick Tips for Extracting Hashes #

• To make the binary plist readable, use the built-in plutil command:

  sudo plutil -p /var/db/dslocal/nodes/Default/users/your-username.plist
  

• The ShadowHashData is stored as binary data, so in your Python script, you can use the plistlib module to load the file, extract this field, then decode it to access the actual hash values.

内容的提问来源于stack exchange，提问作者Tristan Hayes