{"id":13437942,"url":"https://github.com/huntergregal/mimipenguin","last_synced_at":"2025-05-14T19:02:51.052Z","repository":{"id":41284366,"uuid":"86508681","full_name":"huntergregal/mimipenguin","owner":"huntergregal","description":"A tool to dump the login password from the current linux user","archived":false,"fork":false,"pushed_at":"2023-05-17T13:20:46.000Z","size":184,"stargazers_count":3934,"open_issues_count":5,"forks_count":641,"subscribers_count":150,"default_branch":"master","last_synced_at":"2025-04-06T08:08:51.683Z","etag":null,"topics":["password-extraction","post-exploitation"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/huntergregal.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-03-28T21:24:28.000Z","updated_at":"2025-04-05T20:18:01.000Z","dependencies_parsed_at":"2024-01-07T01:39:24.456Z","dependency_job_id":"f74380c4-20d1-4a1f-baaa-536d656b403f","html_url":"https://github.com/huntergregal/mimipenguin","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/huntergregal%2Fmimipenguin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/huntergregal%2Fmimipenguin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/huntergregal%2Fmimipenguin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/huntergregal%2Fmimipenguin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/huntergregal","download_url":"https://codeload.github.com/huntergregal/mimipenguin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248710372,"owners_count":21149185,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["password-extraction","post-exploitation"],"created_at":"2024-07-31T03:01:01.487Z","updated_at":"2025-04-13T11:45:15.950Z","avatar_url":"https://github.com/huntergregal.png","language":"C","funding_links":[],"categories":["C","DevOps Utilities","\u003ca id=\"c49aef477cf3397f97f8b72185c3d100\"\u003e\u003c/a\u003e密码\u0026\u0026凭证","Tools","C (286)","Pentest Methodology","others","\u003ca id=\"862af330f45f21fbb0d495837fc7e879\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"86dc226ae8a71db10e4136f4b82ccd06\"\u003e\u003c/a\u003e密码","Password and Login","Privilege Escalation"],"readme":"# MimiPenguin 2.0\nA tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. This was assigned *CVE-2018-20781* (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781). Fun fact it's still not fixed after GNOME Keyring 3.27.2 and still works as of `3.28.0.2-1ubuntu1.18.04.1`.\n\n![alt text](http://i.imgur.com/BkDX9dF.png \"MimiPenguin\")\n\n## Details\nTakes advantage of cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. Will attempt to calculate each word's probability by checking hashes in /etc/shadow, hashes in memory, and regex searches. 2.0 introduces a clean C port that aims to increase the speed of execution and portability\n\n## Known Issues\n* The 32bit variant of mimipenguin (C build) may fail in a 64bit userspace as it currently does not adequatley handle searching a 64bit address space\n\n## Requires\n* root permissions\n\n## Supported/Tested Systems\n* Kali 4.3.0 (rolling) x64 (gdm3)\n* Ubuntu Desktop 12.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)\n* Ubuntu Desktop 14.04.1 LTS x64 (Gnome Keyring 3.10.1-1ubuntu4.3, LightDM 1.10.6-0ubuntu1)\n* Ubuntu Desktop 16.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)\n* Ubuntu Desktop 16.04.4 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2, LightDM 1.18.3-0ubuntu1.1)\n* Ubuntu 18\n* XUbuntu Desktop 16.04 x64 (Gnome Keyring 3.18.3-0ubuntu2)\n* Archlinux x64 Gnome 3 (Gnome Keyring 3.20)\n* OpenSUSE Leap 42.2 x64 (Gnome Keyring 3.20)\n* VSFTPd 3.0.3-8+b1 (Active FTP client connections)\n* Apache2 2.4.25-3 (Active/Old HTTP BASIC AUTH Sessions) [Gcore dependency]\n* openssh-server 1:7.3p1-1 (Active SSH connections - sudo usage)\n\n## Building\n* To Build the C variant release simply run `make` in the root directory of the project\n* To build a debug binary with debug prints run `make debug`\n* To build a static linked binaries run `make static`\n\n## Notes\n* Password moves in memory - still honing in on 100% effectiveness\n* Plan on expanding support and other credential locations\n* Working on expanding to non-desktop environments\n* Known bug - sometimes gcore hangs the script, this is a problem with gcore\n* Open to pull requests and community research\n* LDAP research (nscld winbind etc) planned for future\n\n## Development Roadmap\n* Implement needles in C port (speed up)\n* Add optional arg to target specific users only (speed up)\n\nMimiPenguin is slowly being ported to multiple languages to support all possible post-exploit scenarios. The roadmap below was suggested by KINGSABRI to track the various versions and features. An \"X\" denotes full support while a \"~\" denotes a feature with known bugs.\n\n| Feature                                           | .sh | .py |\n|---------------------------------------------------|-----|-----|\n| GDM password (Kali Desktop, Debian Desktop)       | ~   | X   |\n| Gnome Keyring (Ubuntu Desktop, ArchLinux Desktop) | ~   | X   |\n| LightDM (Ubuntu Desktop)                          | X   | X   |\n| VSFTPd (Active FTP Connections)                   | X   | X   |\n| Apache2 (Active HTTP Basic Auth Sessions)         | ~   | ~   |\n| OpenSSH (Active SSH Sessions - Sudo Usage)        | ~   | ~   |\n\n## Contact\n* Twitter: [@huntergregal](https://twitter.com/HunterGregal)\n* Website: [huntergregal.com](http://huntergregal.com)\n* Github: [huntergregal](https://github.com/huntergregal)\n\n## Licence\nCC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n## Special Thanks \n* the-useless-one for remove Gcore as a dependency, cleaning up tabs, adding output option, and a full python3 port\n* gentilkiwi for Mimikatz, the inspiration and the twitter shoutout\n* pugilist for cleaning up PID extraction and testing\n* ianmiell for cleaning up some of my messy code\n* w0rm for identifying printf error when special chars are involved\n* benichmt1 for identifying multiple authenticate users issue\n* ChaitanyaHaritash for identifying special char edge case issues\n* ImAWizardLizard for cleaning up the pattern matches with a for loop\n* coreb1t for python3 checks, arch support, other fixes\n* n1nj4sec for a python2 port and support\n* KINGSABRI for the Roadmap proposal\n* bourgouinadrien for linking https://github.com/koalaman/shellcheck\n* bcoles for adding more needles\n* space-r7 and bcoles for work on the [Metasploit MimiPenguin module](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/linux/gather/mimipenguin.md) port\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhuntergregal%2Fmimipenguin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhuntergregal%2Fmimipenguin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhuntergregal%2Fmimipenguin/lists"}