Skip to main content
The Linux Credential Attacks page focuses on extracting locally stored secrets rather than exploiting a misconfiguration to escalate privileges (that’s covered on Linux Privilege Escalation instead). Kerberos keytab/ticket handling on a domain-joined Linux box is covered on the AD Kerberos Ticket Attacks page rather than here, since it’s a domain-wide technique, not a local host one.

​
Shadow File Cracking

With root (or a read primitive on both files), combining /etc/passwd and /etc/shadow into a single crackable file is try worth.
Then crack the password with the following command
See Password Crackingpage if /etc/shadow uses a different hash prefix ($1$, $5$, $2a$), the mode number needs to match. To find Linux Password Hash References check this page.
/etc/security/opasswd stores previous password hashes when password-history enforcement is configured, worth checking (and cracking the same way) even once the current password is known, reused old passwords are common.

​
Browser-Saved Logins (Firefox)

The credentials in logins.json are encrypted, not plaintext, decrypt with firefox_decrypt:

​
Broad Local Credential Sweep

LaZagne covers the same wide net of local applications on Linux as it does on Windows.
linikatz is the Linux equivalent of Mimikatz, dumping credentials from memory, Kerberos caches, and other local secret stores in one pass.

​
Quick Reference Tools

Password Cracking

Crack the unshadowed hash file or any other hash recovered here.

LaZagne

Broad local credential sweep, same tool as the Windows page.

linikatz

Mimikatz-equivalent credential dumping for Linux.