On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to connect to that share, because I think that password might be used elsewhere. My question is, where is the password or password hash stored for mounted CIFS shares? Is it in some process's memory, or in some hidden file somewhere? Is it even possible to retrieve the password used?
Asked
Active
Viewed 139 times
