How to list password files on a Macintosh OSX machine
This is how to list the password files on a Macintosh OSX Mountain Lion machine. Newer Macintosh OSX machines do not use the /etc/shadow file link Linux does, so this is how the account passwords are stored.
Homers-iMac:~ homer$ sudo ls -lah /var/db/dslocal/nodes/Default/users/ Password: total 336 drwx------ 74 root wheel 2.5K 14 Mar 10:13 . drw------- 11 root wheel 374B 14 Mar 10:11 .. -rw-------@ 1 root wheel 260B 21 Jun 2012 _amavisd.plist -rw-------@ 1 root wheel 254B 21 Jun 2012 _appleevents.plist -rw-------@ 1 root wheel 261B 14 Mar 09:39 _appowner.plist -rw-------@ 1 root wheel 276B 14 Mar 09:39 _appserver.plist -rw-------@ 1 root wheel 248B 21 Jun 2012 _ard.plist -rw-------@ 1 root wheel 254B 14 Mar 09:39 _atsserver.plist -rw-------@ 1 root wheel 266B 14 Mar 09:39 _avbdeviced.plist -rw-------@ 1 root wheel 250B 14 Mar 09:39 _calendar.plist -rw-------@ 1 root wheel 258B 14 Mar 09:39 _ces.plist -rw-------@ 1 root wheel 258B 21 Jun 2012 _clamav.plist -rw-------@ 1 root wheel 253B 21 Jun 2012 _coreaudiod.plist -rw-------@ 1 root wheel 241B 14 Mar 09:39 _cvmsroot.plist -rw-------@ 1 root wheel 236B 21 Jun 2012 _cvs.plist -rw-------@ 1 root wheel 263B 21 Jun 2012 _cyrus.plist -rw-------@ 1 root wheel 265B 14 Mar 09:39 _devdocs.plist -rw-------@ 1 root wheel 259B 14 Mar 09:39 _devicemgr.plist -rw-------@ 1 root wheel 257B 21 Jun 2012 _dovecot.plist -rw-------@ 1 root wheel 256B 21 Jun 2012 _dovenull.plist -rw-------@ 1 root wheel 239B 14 Mar 09:39 _dpaudio.plist -rw-------@ 1 root wheel 253B 21 Jun 2012 _eppc.plist -rw-------@ 1 root wheel 246B 14 Mar 09:39 _ftp.plist -rw-------@ 1 root wheel 248B 14 Mar 09:39 _geod.plist -rw-------@ 1 root wheel 260B 14 Mar 09:39 _installassistant.plist -rw-------@ 1 root wheel 245B 14 Mar 09:39 _installer.plist -rw-------@ 1 root wheel 271B 14 Mar 09:39 _jabber.plist -rw-------@ 1 root wheel 264B 14 Mar 09:39 _kadmin_admin.plist -rw-------@ 1 root wheel 279B 21 Jun 2012 _kadmin_changepw.plist -rw-------@ 1 root wheel 276B 21 Jun 2012 _krb_anonymous.plist -rw-------@ 1 root wheel 289B 21 Jun 2012 _krb_changepw.plist -rw-------@ 1 root wheel 277B 14 Mar 09:39 _krb_kadmin.plist -rw-------@ 1 root wheel 265B 14 Mar 09:39 _krb_kerberos.plist -rw-------@ 1 root wheel 286B 21 Jun 2012 _krb_krbtgt.plist -rw------- 1 root wheel 666B 14 Mar 10:11 _krbtgt.plist -rw-------@ 1 root wheel 249B 21 Jun 2012 _lda.plist -rw-------@ 1 root wheel 259B 21 Jun 2012 _locationd.plist -rw-------@ 1 root wheel 256B 21 Jun 2012 _lp.plist -rw-------@ 1 root wheel 261B 21 Jun 2012 _mailman.plist -rw-------@ 1 root wheel 251B 21 Jun 2012 _mcxalr.plist -rw-------@ 1 root wheel 249B 21 Jun 2012 _mdnsresponder.plist -rw-------@ 1 root wheel 248B 14 Mar 09:39 _mysql.plist -rw-------@ 1 root wheel 238B 21 Jun 2012 _netbios.plist -rw-------@ 1 root wheel 264B 21 Jun 2012 _netstatistics.plist -rw-------@ 1 root wheel 249B 21 Jun 2012 _networkd.plist -rw-------@ 1 root wheel 271B 14 Mar 09:39 _postfix.plist -rw-------@ 1 root wheel 251B 14 Mar 09:39 _postgres.plist -rw-------@ 1 root wheel 262B 14 Mar 09:39 _qtss.plist -rw-------@ 1 root wheel 248B 14 Mar 09:39 _sandbox.plist -rw-------@ 1 root wheel 246B 14 Mar 09:39 _screensaver.plist -rw-------@ 1 root wheel 258B 14 Mar 09:39 _scsd.plist -rw-------@ 1 root wheel 265B 21 Jun 2012 _securityagent.plist -rw-------@ 1 root wheel 274B 21 Jun 2012 _serialnumberd.plist -rw-------@ 1 root wheel 265B 21 Jun 2012 _softwareupdate.plist -rw-------@ 1 root wheel 253B 14 Mar 09:39 _spotlight.plist -rw-------@ 1 root wheel 261B 21 Jun 2012 _sshd.plist -rw-------@ 1 root wheel 236B 14 Mar 09:39 _svn.plist -rw-------@ 1 root wheel 250B 14 Mar 09:39 _taskgated.plist -rw-------@ 1 root wheel 267B 14 Mar 09:39 _teamsserver.plist -rw-------@ 1 root wheel 252B 14 Mar 09:39 _timezone.plist -rw-------@ 1 root wheel 250B 21 Jun 2012 _tokend.plist -rw-------@ 1 root wheel 270B 14 Mar 09:39 _trustevaluationagent.plist -rw-------@ 1 root wheel 252B 14 Mar 09:39 _unknown.plist -rw-------@ 1 root wheel 257B 14 Mar 09:39 _update_sharing.plist -rw-------@ 1 root wheel 264B 14 Mar 09:39 _usbmuxd.plist -rw-------@ 1 root wheel 265B 21 Jun 2012 _uucp.plist -rw-------@ 1 root wheel 240B 14 Mar 09:39 _warmd.plist -rw-------@ 1 root wheel 254B 14 Mar 09:39 _webauthserver.plist -rw-------@ 1 root wheel 262B 21 Jun 2012 _windowserver.plist -rw-------@ 1 root wheel 265B 14 Mar 09:39 _www.plist -rw-------@ 1 root wheel 243B 21 Jun 2012 daemon.plist -rw------- 1 root wheel 161K 14 Mar 10:13 homer.plist -rw-------@ 1 root wheel 266B 14 Mar 09:39 nobody.plist -rw-------@ 1 root wheel 288B 14 Mar 09:39 root.plist |
This lists all of the accounts on the machine. This allows you to get hold of a password file to attack.
There is a tutorial here, this lists the steps required to crack a Macintosh Mountain Lion password file. This requires Administrator access on a Macintosh machine.
Get the password files on a Macintosh OSX Sierra machine.
http://securitronlinux.com/bejiitaswrath/how-to-list-the-password-files-on-a-macintosh-osx-lion-computer/. Also how to get ahold of the password hash and the salt.