How to get the hash linked to a GeneratedUID in El Capitan?

The hashes of the users are stored in a different place since 10.7:

/var/db/dslocal/nodes/Default/users/<user>.plist

To get the shadow hash enter:

sudo defaults read /var/db/dslocal/nodes/Default/users/<user>.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

or directly through directory services:

sudo dscl . read /Users/<user> AuthenticationAuthority

and

sudo dscl . read /Users/<user> dsAttrTypeNative:ShadowHashData

Related