How to find root password hash without root on osx 10.13 High Sierra

Question

I'm going to be using John the Ripper to decrypt the password hash but I don't know where the hash is stored.

Answer 1

The password hash and salt of any user are located here:

/var/db/dslocal/nodes/Default/users/<user>.plist

You will get a Permission denied if you try to access it without sudo.

The only way I know to access it without the sudo password is to reboot in Single User Mode (with command+s)

Once you get there, it's a little tricky to actually get the file and decode it. You have a detailed step by step guide here in the Michael Fairley website (original website no longer available)