Why doesn't defaults read` work for obtaining ShadowHashData key in user.plist?

4 votes

1 answer

1971 views

terminal password user-account open-directory

                          I've read how to obtain the user's password hash on OSX using sudo defaults read /var/db/dslocal/nodes/Default/users/user.plist ShadowHashData.

However, after giving Terminal "Full Disk Access" on macOS Mojave, I get the following error:

    The domain/default pair of (/var/db/dslocal/nodes/Default/users/user.plist, ShadowHashData) does not exist.

However, the ShadowHashData key can be read by plutil and dscl, so why don't defaults work?

Edit:

dscl (works for obtaining user's hash):

    nlykkei-mbp:~ nlykkei$ sudo dscl . -read /Users/nlykkei dsAttrTypeNative:ShadowHashData
    dsAttrTypeNative:ShadowHashData:
     62706c69 73743030 d2010203 ...

defaults (doesn't work for obtaining user's hash):

    sudo defaults read /var/db/dslocal/nodes/Default/users/nlykkei ShadowHashData
    2019-08-07 09:16:32.697 defaults[1123:33825] 
    The domain/default pair of (/var/db/dslocal/nodes/Default/users/nlykkei, ShadowHashData) does not exist


whoami (user's identity):

    nlykkei-mbp:~ nlykkei$ whoami
    nlykkei
    nlykkei-mbp:~ nlykkei$ id
    uid=501(nlykkei) gid=20(staff) groups=20(staff),502(access_bpf),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),701(com.apple.sharepoint.group.1)

uname (OS version):

    nlykkei-mbp:~ nlykkei$ uname -a
    Darwin nlykkei-mbp 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64

defaults (works without domain argument):

    nlykkei-mbp:~ nlykkei$ sudo defaults read | head -n 10
    {
        "Apple Global Domain" =     {
            AKLastIDMSEnvironment = 0;
            AppleKeyboardUIMode = 3;
            "com.apple.sound.beep.flash" = 0;
        };
        bluetoothaudiod =     {
        };
        "com.apple.AppleMultitouchMouse" =     {
            MouseButtonDivision = 55;
     ...

                        

Asked by Shuzheng (1681 rep)

Aug 6, 2019, 08:49 AM
Last activity: Mar 9, 2020, 09:49 AM

Why doesn't defaults read` work for obtaining ShadowHashData key in user.plist?

Related Questions