mimipenguin
Extracts cleartext passwords from Linux process memory.
The mimikatz equivalent for Linux, with a more modest reach. It reads the memory of processes that have handled the user's password (`gdm`, `lightdm`, `sshd`, `vsftpd`, `apache`) and looks for strings that validate against the `/etc/shadow` hash. It needs root, so it is not an escalation tool but a **harvesting** one: the local user's cleartext password is what opens the next lateral move, where a hash is no use.
Family Credential dumping & theft
Flags (requiere root)
Concepts Credential Hunting, Process memory dump with gcore
Cheatsheet Enumeration
Installation
git clone https://github.com/huntergregal/mimipenguin
sudo bash mimipenguin/mimipenguin.sh # o: sudo python3 mimipenguin/mimipenguin.pyUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.