Kcpass

Description

Decrypt the password store in "/etc/kcpassword" when autologin session is enabled.

Installation

$ curl -O https://raw.githubusercontent.com/jjarava/mac-osx-forensics/master/kcpass.py
$ chmod +x kcpass.py

Example

$ ./kcpass.py $(xxd -p kcpassword)

       Kcpasswd: 0x1bb92010bccfec89c0d52b0bb86123b57ab499f2465591a0.
       Magic Xor: 0x7d895223d2bcddeaa3b91f.
       Used Magic Xor: 0x7d895223d2bcddeaa3b91f7d895223d2bcddeaa3b91f7d895223d2bcddeaa3b91f.

       The password is: "*****s1ccl4v13".