3 ms·

`sudo dscl . -read Users/root accountPolicyData`

edjw 9y ago
When you do this you'll get the creationTime and passwordLastSetTime as seconds since the 'epoch' – January 1, 1970, 00:00:00 (UTC). These are numbers like 1474441704.265237 which aren't very easy for a human to read :-) To convert this into a human-readable date and time, open a terminal and do this: python >>> import time >>> time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(1474441704.265237)) You'll get something like 'Wed, 21 Sep 2016 07:08:24' (I'm sure you can do this in other languages than python...)
- fauigerzigerk 9y ago
  If you're already in the terminal you could instead enter date -r 1474441704
  - edjw 9y ago
    This is a much better answer!
mhandley 9y ago
One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited. If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigger picture.
- marcelfahle 9y ago
  My root pw passwordLastSetTime says this morning.. the fuck??
- marcelfahle 9y ago
  OK, I guess when doing OP's root trick, the root user gets activated/created, and that's that's when the PW gets set to empty. I guess that's where my passwordLastSetTime comes from.
- danielrangel 9y ago
  possibly the same timestamp here: 1510300538.767916 'Fri, 10 Nov 2017 04:55:38'
  - gurkendoktor 9y ago
    Oh wow. Is there any other explanation for this other than this having been exploited in the wild for almost three weeks? Or maybe someone just tried to log in over SSH to exploit some other weakness (something like predictable SSH passwords on jailbroken iOS devices), and happened to create the root user on your machine? Did you also have sshd running, and do you know what kind of network you were using at the time?
- haZard_OS 9y ago
  This works remotely as well (although not through SSH, obviously).

edjw 9y ago

When you do this you'll get the creationTime and passwordLastSetTime as seconds since the 'epoch' – January 1, 1970, 00:00:00 (UTC). These are numbers like 1474441704.265237 which aren't very easy for a human to read :-) To convert this into a human-readable date and time, open a terminal and do this: python >>> import time >>> time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(1474441704.265237)) You'll get something like 'Wed, 21 Sep 2016 07:08:24' (I'm sure you can do this in other languages than python...)

fauigerzigerk 9y ago
If you're already in the terminal you could instead enter date -r 1474441704
- edjw 9y ago
  This is a much better answer!

mhandley 9y ago

One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited. If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigger picture.

marcelfahle 9y ago
My root pw passwordLastSetTime says this morning.. the fuck??
marcelfahle 9y ago
OK, I guess when doing OP's root trick, the root user gets activated/created, and that's that's when the PW gets set to empty. I guess that's where my passwordLastSetTime comes from.
danielrangel 9y ago
possibly the same timestamp here: 1510300538.767916 'Fri, 10 Nov 2017 04:55:38'
- gurkendoktor 9y ago
  Oh wow. Is there any other explanation for this other than this having been exploited in the wild for almost three weeks? Or maybe someone just tried to log in over SSH to exploit some other weakness (something like predictable SSH passwords on jailbroken iOS devices), and happened to create the root user on your machine? Did you also have sshd running, and do you know what kind of network you were using at the time?
haZard_OS 9y ago
This works remotely as well (although not through SSH, obviously).