5 ms·
Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted pass
by ajani 10y ago
Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords.
Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.
- aftaylor2 10y agoI can confirm this works on 10.11.5 ( El Capitan ). To confirm, you can "cat keychain.txt | grep -i SECTION_OF_YOUR_PASSWORD". However, you must click Allow on each dialog, or Always Allow.
- gilgoomesh 10y agoDid you run the AppleScript? I got the expected error: > error "System Events got an error: Can’t get group 1 of window 1 of process \"SecurityAgent\". Invalid index." number -1719 from group 1 of window 1 of process "SecurityAgent" You're not supposed to be able to script SecurityAgent – and it doesn't work on my computer. Specifically, security windows should appear empty when read by other processes.
- csydas 10y agoSnippet from the man page for security: https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html https://developer.apple.com/legacy/library/documentation/Dar... >dump-keychain [-adhir] Dump the contents of one or more keychains. -a Dump access control list of items -d Dump (decrypted) data of items -i Interactive access control list editing mode -r Dump raw (encrypted) data of items I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dumps all data in plain-text as the article suggested. I am curious if the keychain was unlocked when they did it for whatever reason. I still question why such an ability exists through terminal without more control, but it's not quite as described. edit: was very unclear I was posting a snippet of the actual command. fixed
- coldcode 10y agodump-keychain: command not found
- coldcode 10y agohttp://apple.stackexchange.com/questions/184897/how-to-dump-the-content-of-keychain-from-the-shell http://apple.stackexchange.com/questions/184897/how-to-dump-... This is nothing new apparently
- csydas 10y agoah, I was not clear I was posting a snippet from the man, and also forgot the link to it. mybad
- Karunamon 10y agoThe name of the main command is 'security', with 'dump-keychain' being an argument.
- throwaway2016a 10y agoI can confirm that at least on mine the passwords are definitely plain text (also includes some private keys) but the Apple script doesn't work for me so there doesn't seem to be a way to suppress the Allow/Deny box. I am a little surprised it doesn't ask foe the keychain password.
- pdxandi 10y agoI believe you've surfaced the real issue – there's no confirmation prompt that requires the keychain password.
- dfraser992 10y agoOn 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.
- rangibaby 10y agoThe new security was added in 10.11 afaik
- brenton07 10y agoWonder if it got bumped on accident on a recent update. My system has been modified to allow system access, so its less surprising (although still a flaw). But we did it on machines by people that are probably TOTALLY unaware of those 10.11 changes and wouldn't have the know how to modify something like that, and it still worked on their machines.
- rangibaby 10y agoThey might have turned it down or off because it was buggy. Trying to get a password out of my keychain using Screen Sharing completely hosed it (10.11 initial release). Even opening Keychain Access resulted in an instant freeze and spinning wheel. I ended up having to completely recreate my keychain and reset a lot of passwords.