Retrieving wifi passwords from NVRAM:

    /usr/libexec/airportd readNVRAM

Alternatively:

    nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:current-network
    nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-networks
    nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-count