## https://sploitus.com/exploit?id=53D8970C-4372-5226-902B-B571B5A70FBA
# KeePass 2.53/cmdline` files and store the `pid` of ones with the keyword `KeePass` in their commandline argument.
It'll then acquire the adresses of memory maps in `/proc//maps` that aren't directly associated with a library, meaning they have an empty file path.
It'll then store the memory of all those maps into a buffer by taking advantage of `/proc//mem`. This would be a primitive behaviour to dump the memory of any process on Linux.
It'll parse the memory to try and find leftover strings from when the user typed his master password, strings that look like so `•a, ••s, •••s`, in sequence . The first letter will be missing. You can find some other functionality by looking at the code.
`gcc dump_pwd.c -o dump` and you're ready to go.
