mimipenguin – A Tool To Dump The Login Password From The Current Linux User

A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz.

Details

Takes advantage of cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. Will attempt to calculate each word’s probability by checking hashes in /etc/shadow, hashes in memory, and regex searches.

Requires

root permissions

Supported/Tested Systems

Kali 4.3.0 (rolling) x64 (gdm3)

Ubuntu Desktop 12.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)

Ubuntu Desktop 16.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)

XUbuntu Desktop 16.04 x64 (Gnome Keyring 3.18.3-0ubuntu2)

Archlinux x64 Gnome 3 (Gnome Keyring 3.20)

VSFTPd 3.0.3-8+b1 (Active FTP client connections)

Apache2 2.4.25-3 (Active/Old HTTP BASIC AUTH Sessions) [Gcore dependency]

openssh-server 1:7.3p1-1 (Active SSH connections – sudo usage)

Notes

Password moves in memory – still honing in on 100% effectiveness

Plan on expanding support and other credential locations

Working on expanding to non-desktop environments

Known bug – sometimes gcore hangs the script, this is a problem with gcore

Open to pull requests and community research

LDAP research (nscld winbind etc) planned for future

Development Roadmap

MimiPenguin is slowly being ported to multiple languages to support all possible post-exploit scenarios. The roadmap below was suggested by KINGSABRI to track the various versions and features. An “X” denotes full support while a “~” denotes a feature with known bugs.

Feature

.sh

.py

GDM password (Kali Desktop, Debian Desktop)

~

X

Gnome Keyring (Ubuntu Desktop, ArchLinux Desktop)

X

X

VSFTPd (Active FTP Connections)

X

X

Apache2 (Active HTTP Basic Auth Sessions)

~

~

OpenSSH (Active SSH Sessions – Sudo Usage)

~

~

Download mimipenguin http://ift.tt/2pJKDOR http://ift.tt/2aM8QhC

Anúncios

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s