Ctrlk
Infiltr8ForumGitHub
For the complete documentation index, see llms.txt. This page is also available as Markdown.

In-memory secrets

MITRE ATT&CK™ OS Credential Dumping: Proc Filesystem - Technique T1003.007

Theory

Just like the LSASS process on Windows systems allowing for LSASS dumping, some programs sometimes handle credentials in the memory allocated to their processes, sometimes allowing attackers to dump them.

Practice

On UNIX-like systems, tools like mimipenguin (C, Shell, Python), mimipy (Python) and LaZagne (Python) can be used to extract passwords from memory.

mimipenguin
laZagne memory

Resources

LogoOS Credential Dumping: Proc Filesystem, Sub-technique T1003.007 - Enterprise | MITRE ATT&CK®attack.mitre.org

Last updated