Dumps local MacOS user hashes to a hashcat-compatible string.
Simply uses Objective-C instead of dscl/defaults read or other noisy binaries, to extract relevant data from ShadowHashData.
Pre-built binaries available in Releases:
mimic-arm64- Apple Silicon (M1/M2/M3/M4)mimic-x86_64- Intel
Open in vscode in a mac and press F5, OR
clang -framework Foundation -framework AppKit -framework Collaboration main.m -o mimic
chmod +x mimic
sudo ./mimic
The output per user is formatted as follows:
someLocalUser: + $ml + $iterations + $salt + $entropy
To crack the hashes using hashcat:
hashcat -m 7100 hashes.txt wordlist.txt --username
Tested in Catalina, Mojave, Monterey, Ventura, Sequoia, Tahoe - supports both x86_64 and arm64 (Apple Silicon).