macOS is a relatively common sight within many modern company environments. Despite this, there don’t seem to be many decent sources around for how to dump local user hashes for offline pasword cracking attacks. This post is a short writeup on how to access and transform hashes into a form hashcat can use.

A good bit has been written about using high-level languages to obtain code execution and persistence within an environment. This post refines these techniques a bit further, discussing how PYTHONPYCACHEPREFIX can be used to obtain even more covert execution.

External pentests and red teams often need reliable techniques for identifying and validating target users. Traditional methods like TeamsEnum and onedrive_user_enum are useful, but can be false positive-prone or require further authentication. The PowerBI API exposes an unauthenticated endpoint that returns a definitive {“accountExists”:true} or a 404/500, which can be used to enumerate valid email addresses for a given organization.