Exporting User Credentials from the Proc File System Through MimiPenguin

Environment Description

Preface

Introduction to the Proc File System

• The proc file system is a pseudo-file system that exists only in memory. It provides an interface, in the form of a file system, for operations that access operating-system kernel data. Users and applications can obtain a large amount of information about the state of the running operating system through the Proc file system.
• Basic process information is stored in the /proc file system, specifically under the /proc directory. The following command can be used to view information about processes running in the system.

ls /proc

Principle of Credential Export

• A process running with root privileges can use Proc to capture the live memory of other running processes. If those processes store passwords in plaintext or store password hashes in memory, an attacker can collect those credentials.
• Tools commonly used for this technique include MimiPenguin and LaZagne's mimipy.py.

Reproduction Process

Export Credentials Through MimiPenguin

• Download MimiPenguin. Its Github address is as follows:

https://github.com/huntergregal/mimipenguin

• Run MimiPenguin with root privileges

sudo ./mimipenguin.sh

• The exported credentials are shown below:

• As shown above, the plaintext credentials of our system user were obtained