Is it possible to dump a Linux password in clear text format? In Windows it is possible to do so using "Windows Credential Editor".
Yes, it's possible.
The WCE product you reference works by scraping passwords directly out of memory. That method also works in Linux; a rootkit which has unfettered access to memory and can hook system calls can extract passwords from there - consider this example, which can steal username and password pairs
Both solutions are limited in that they
- can only capture passwords as they're used - someone has to log in to have their password compromised, it's not dumping the authentication store for everyone.
- require the OS to be hooked - let's just say compromised - at a deep level.
There is relativly persistant way to dump clear text password. The swap file. Linux passwords are very often stored in swap in clear text. To dump them you can use a tool like swap_digger
This solution requires root access.
The short answer is no, because the password file only contains non invertible hashes.
That being said is you have administrative priviledges on a machine, you have many ways to gather passwords:
- use a password cracker like JohnTheRipper - in some organizations, it is enough to get more than 50% or the total users passwords
- if the passwords are used unencrypted (plain POP, IMAP or FTP) a simple spy on the network interface will give them
- many services use PAM on Linux. It is easy to modify the pam_unix module to store the plain text password.
Of course this would be an internal security attack and an administrator should never do that without very special reasons.