script to extract (and then scramble) macOS user password hash from system .plist file

extract_and_scramble_hashcat_hash.sh

#!/bin/bash

extractOsXUserHash() { 
    xmlOfUsertPlist="$( \
        plutil -convert xml1 - -o - \
    )"
    if [ -z "$xmlOfUsertPlist" ] ; then \
        1>&2 echo "No input detected"
        exit 127
    fi
    lineNoRange=$( \
        echo $( \
            echo "$xmlOfUsertPlist" | \
                nl -b a | \
                grep -E '</?(data|key)>' | \
                grep -EA2 '<key>\s*ShadowHashData\s*</key>' | \
                tr -s $' \t' ' ' | \
                tail +2 | \
                cut -d' ' -f2 \
        ) | \
            tr ' ' - \
    )
    saltedHashXml="$( \
        echo "$xmlOfUsertPlist" | \
            head -$(( \
                $( \
                    echo $lineNoRange | \
                        cut -d- -f2 \
                ) - 1 \
            )) | \
            tail +$(( \
                $( \
                    echo $lineNoRange | \
                        cut -d- -f1 \
                ) + 1 \
            )) | \
            base64 -D | \
            plutil -convert xml1 - -o - 2>/dev/null \
    )"
    saltedHashLineNoRange=$( \
        echo $( \
            echo "$saltedHashXml"  | \
                nl -b a | \
                grep -E '(</?dict>|<key>\s*SALTED-SHA512-PBKDF2)' | \
                grep -EA2 '<key>\s*SALTED-SHA512-PBKDF2\s*</key>' | \
                tr -s $' \t' ' ' | \
                tail +2 | \
                cut -d' ' -f2\
        ) | \
            tr ' ' - \
    )
    saltedHashSection="$( \
        echo "$saltedHashXml" | \
            head -$(( \
                $( \
                    echo $saltedHashLineNoRange | \
                        cut -d- -f2 \
                ) - 1 \
            )) | \
            tail +$(( \
                $( \
                    echo $saltedHashLineNoRange | \
                        cut -d- -f1 \
                ) + 1 \
            )) \
    )"
    echo "\$ml\$$( \
        echo "$saltedHashSection" | \
            grep -EA1 '<key>\s*iterations\s*</key>' | \
            tail -1 | \
            sed -E -e 's,</?integer>,,g' | \
            tr -d $' \t' \
    )\$"$( \
        echo $( \
            for keyname in salt entropy; do \
                range=$( \
                    echo $( \
                        echo "$saltedHashSection" | \
                            nl -b a | \
                            grep -E '</?(data|key)>' | \
                            grep -EA2 "<key>\\s*$keyname\\s*</key>" | \
                            tr -s $' \t' ' ' | \
                            tail +2 | \
                            cut -d' ' -f2 \
                    ) | \
                        tr ' ' - 
                ) ; \
                echo $( \
                    echo "$saltedHashSection" | \
                        head -$(( \
                            $( \
                                echo $range | \
                                    cut -d- -f2 \
                            ) - 1 \
                        )) | \
                        tail +$(( \
                            $( \
                                echo $range | \
                                    cut -d- -f1 \
                            ) + 1 \
                        )) | \
                        base64 -D | \
                        xxd -p \
                ) | \
                    tr -d ' ' ; \
            done \
        ) | \
            tr ' ' '$' 
    )
}

scrambleHash() {
    echo $( \
        for part in $( \
            sed -e 's/\$/$%$/g' | \
                tr '$' $'\n' \
        ) ; do \
            if echo "$part" | grep -qE '.{8}' ; then \
                echo "$part" | \
                    sed -e 's/\(........\)/\1#/g' | \
                    tr '#' $'\n' | \
                    sort -R ; \
            else \
                echo "$part" ; \
            fi ; \
        done \
    ) | \
        tr -d ' ' | \
        tr '%' '$'
}

cat SysHD__var_db_dslocal_nodes_Default_users_username.plist | extractOsXUserHash | scrambleHash