MimiPenguin is a free and open source, simple yet powerful Shell/Python script used to extract login credentials (usernames and passwords) from the current Linux desktop user. It has been tested across various Linux distributions.

Moreover, it supports applications like VSFTPd (active FTP client connections), Apache2 (active or old HTTP BASIC AUTH sessions, which require Gcore), and OpenSSH-server (active SSH connections involving sudo command usage).

Importantly, it is being gradually ported into multiple languages to support a wide range of post-exploit scenarios.

How Does MimiPenguin Work?

To understand how MimiPenguin operates, you should remember that nearly all Linux distributions store critical information such as credentials, encryption keys, and personal data in memory.

In particular, usernames and passwords are kept by running processes in memory and often remain in plain text for extended durations.

MimiPenguin exploits this behavior by dumping process memory and scanning for lines likely to contain clear-text credentials.

It then attempts to assess the likelihood of each word being a valid password by checking hashes in /etc/shadow, memory, and using regex searches. If matches are found, they are printed to standard output.

Installing MimiPenguin on Linux Systems

We will use git to clone the MimiPenguin repository, so first install git if it's not already present on your system.

<code>$ sudo apt install git         [On <strong>Debian, Ubuntu and Mint</strong>]
$ sudo yum install git         [On <strong>RHEL/CentOS/Fedora</strong> and <strong>Rocky/AlmaLinux</strong>]
$ sudo emerge -a git           [On <strong>Gentoo Linux</strong>]
$ sudo apk add git             [On <strong>Alpine Linux</strong>]
$ sudo pacman -S git           [On <strong>Arch Linux</strong>]
$ sudo zypper install git      [On <strong>OpenSUSE</strong>]    </code>

Next, clone the MimiPenguin repository to your home directory (or any other location):

<code>$ git clone https://github.com/huntergregal/mimipenguin.git</code>

View Linux User Passwords

After downloading, navigate into the cloned directory and execute mimipenguin.sh:

<code>$ cd mimipenguin/
$ ./mimipenguin.sh </code>

Note: If you encounter the following error, run the script with sudo:

<code>Root required - You are dumping memory...
Even mimikatz requires an administrator</code>

As shown above, mimipenguin reveals the desktop environment along with the username and password.

Alternatively, you can run the Python version instead:

<code>$ sudo ./mimipenguin.py</code>

Note that sometimes gcore may cause the script to hang (a known issue with gcore).

Future Updates

Here’s a list of features planned for future versions of mimipenguin:

• Enhancing overall efficiency
• Expanding support for additional credential locations
• Adding capabilities for non-desktop environments
• Including LDAP authentication support

You might also like:

• How to Password Protect a Vim File in Linux
• How to Generate Random Passwords in Linux
• How to Set GRUB2 Password in RHEL, CentOS, and Fedora Linux
• How to Setup SSH Passwordless Login in Linux [3 Easy Steps]
• How to Switch (su) to Another User Account without Password

Feel free to share any suggestions related to the mimipenguin tool or concerns about cleartext credentials in Linux memory via the comments below.

The above is the detailed content of MimiPenguin - Dump (Hack) Login Passwords of Linux Users. For more information, please follow other related articles on the PHP Chinese website!