3

Is it possible to dump a Linux password in clear text format? In Windows it is possible to do so using "Windows Credential Editor".

6

Yes, it's possible.

The WCE product you reference works by scraping passwords directly out of memory. That method also works in Linux; a rootkit which has unfettered access to memory and can hook system calls can extract passwords from there - consider this example, which can steal username and password pairs

Both solutions are limited in that they

  • can only capture passwords as they're used - someone has to log in to have their password compromised, it's not dumping the authentication store for everyone.
  • require the OS to be hooked - let's just say compromised - at a deep level.
1
  • 1
    Is there any equivalent to WCE for Linux ? – isoman Jun 25 '15 at 12:35
3

There is relativly persistant way to dump clear text password. The swap file. Linux passwords are very often stored in swap in clear text. To dump them you can use a tool like swap_digger

This solution requires root access.

2
  • Do you have a source for "Linux passwords are very often stored in swap in clear text." ? – user2313067 Aug 17 '17 at 21:25
  • @user2313067 It's true. Whenever an application that does not lock memory handles a password, there is a chance that it will be written to the swap file which is, by default, unencrypted. – forest Jun 15 '18 at 6:40
0

The short answer is no, because the password file only contains non invertible hashes.

That being said is you have administrative priviledges on a machine, you have many ways to gather passwords:

  • use a password cracker like JohnTheRipper - in some organizations, it is enough to get more than 50% or the total users passwords
  • if the passwords are used unencrypted (plain POP, IMAP or FTP) a simple spy on the network interface will give them
  • many services use PAM on Linux. It is easy to modify the pam_unix module to store the plain text password.

Of course this would be an internal security attack and an administrator should never do that without very special reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.