> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Credentials Attacks

The Linux Credential Attacks page focuses on extracting locally stored secrets rather than exploiting a misconfiguration to escalate privileges (that's covered on [Linux Privilege Escalation](https://0-x.dev/linux/linux-privilege-escalation.md) instead). Kerberos keytab/ticket handling on a domain-joined Linux box is covered on the [AD Kerberos Ticket Attacks](https://0-x.dev/ad/kerberos-ticket-attacks.md) page rather than here, since it's a domain-wide technique, not a local host one.

***

## Shadow File Cracking

With root (or a read primitive on both files), combining `/etc/passwd` and `/etc/shadow` into a single crackable file is try worth.

```bash theme={null}
sudo cp /etc/passwd /tmp/passwd.bak
sudo cp /etc/shadow /tmp/shadow.bak
unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashes
```

Then crack the password with the following command

```bash theme={null}
hashcat -m 1800 -a 0 /tmp/unshadowed.hashes <wordlist> -o /tmp/unshadowed.cracked   # sha512crypt, the modern default
```

> [!NOTE]
>
> See [Password Cracking](https://0-x.dev/password-cracking.md)page  if `/etc/shadow` uses a different hash prefix (`$1$`, `$5$`, `$2a$`), the mode number needs to match. To find Linux [Password Hash References](https://0-x.dev/linux/linux-os-enumeration.md) check this page.

> [!TIP]
>
> `/etc/security/opasswd` stores previous password hashes when password-history enforcement is configured, worth checking (and cracking the same way) even once the current password is known, reused old passwords are common.

***

## Browser-Saved Logins (Firefox)

```bash theme={null}
ls -l ~/.mozilla/firefox/ | grep default              # find the active profile folder
cat ~/.mozilla/firefox/*.default-release/logins.json | jq
```

The credentials in `logins.json` are encrypted, not plaintext, decrypt with firefox\_decrypt:

```bash theme={null}
python3 firefox_decrypt.py
```

***

## Broad Local Credential Sweep

[LaZagne](https://github.com/AlessandroZ/LaZagne) covers the same wide net of local applications on Linux as it does on Windows.

```bash theme={null}
python3 laZagne.py all -v
```

[linikatz](https://github.com/CiscoCXSecurity/linikatz) is the Linux equivalent of Mimikatz, dumping credentials from memory, Kerberos caches, and other local secret stores in one pass.

***

## Quick Reference Tools

> **[Password Cracking](https://0-x.dev/password-attacks/cracking)**
>
> Crack the unshadowed hash file or any other hash recovered here.

> **[LaZagne](https://github.com/AlessandroZ/LaZagne)**
>
> Broad local credential sweep, same tool as the Windows page.

> **[linikatz](https://github.com/CiscoCXSecurity/linikatz)**
>
> Mimikatz-equivalent credential dumping for Linux.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.