From the top of my head, passwords are stored in the xf_user_authenticate table. That might be slightly wrong, so look for something that resembles that. It's a 'data' column (or related) that contains the passwords.
They're encrypted in bcrypt with a cost factor of 10.
