Collecting macOS password hashes
macOS stores secrets in a different manner than other operating systems we have seen to date, and as such, an explanation of how these secrets are stored is needed.
In macOS, anything that would be considered a secret in the operating system is stored in a file called the keychain. This file is essentially a store for all the secrets that are protected by macOS. This can include, but is not limited to, the following:
- Network passwords
- Application passwords
- Form fill for Safari (web browser)
- Cryptographic keys
- Wi-Fi passwords
- Trusted certificate authorities
While all this is very interesting, the focus of this section is on the macOS password, also known as the login password, for macOS – the password the user enters to sign into the system itself. The reason the macOS keychain is relevant to this objective is because the user login password is used to encrypt the keychain. This means that if we can successfully...
