What are you talking about? Bitcoin Core wallet.dat use encryption-based security model, not authentication/authorization-based security model (which usually used for online account)
I'm not that familiar with Bitcoin Core, but AFAIK you can get a wallet's password hash with
JohnTheRipper.
Dave from WalletRecoveryServices (a trusted service to recover wallet passwords, and only charges 20%) also shows a way of getting some info from the wallet needed to crack the password without compromising it:
https://walletrecoveryservices.com/limited/It's not technically the password hash. Bitcoin Core stores a master encryption key which is used to encrypt the actual private keys. This master encryption key is encrypted with the user password after it has been through some key stretching (the specific parameters of the key stretching and encryption can vary, so these are stored along with the master encryption key). So you can extract the encrypted master encryption key along with its metadata from the wallet.dat file (not hard to do with existing BDB dump/modification tools) and bruteforce against that to get the password.
This only reveals the password and the master encryption key, not the private keys themselves. So funds are safe if only the master encryption key record is given.
