A red team tool that assists into extracting/dumping master credentials and/or entries from different password managers.
A red team tool that assists into extracting/dumping master credentials and/or entries from different password managers.
[![Contributors][contributors-shield]][contributors-url] [![Forks][forks-shield]][forks-url] [![Stargazers][stars-shield]][stars-url] [![Issues][issues-shield]][issues-url] [![MIT License][license-shield]][license-url] [![Arsenal][arsenal-shield]][arsenal-url]
Table of Contents
About The Project
Built With
Getting Started
Installation
Usage
Prerequisites
Methodology
License
Contact
Acknowledgments
This is a red team tool that assists in gathering credentials from different password managers. They are separated into three categories, Windows 10 desktop applications, browsers, and browser plugins. This may work on other OS, like Linux, but it is not tested yet. In this release (v1.0), the tool supports 14 password managers, with 18 different implementations (e.g., the tool could dump credentials either from the desktop app, or the browser plugin of the same product). Specifically, in most cases, password managers must be up and unlocked for the tool to work.
The tool can be executed in Full, Fast, and Local modes. Full mode dumps and checks all processes of this password manager. Fast mode checks the most common process that usually contains the credentials. Local mode checks the dump file locally. Also, local mode has the "merge" option that can assist in merging multiple dump files into one, before doing the analysis. Additionally, the tool can check if a directory of a password manager exists to assist the user in identifying which password manager can be used in this host. The tool will only need common user's permissions to be able to dump a process from a password manager. Only the 1Password desktop app requires high integrity privileges for the user to be able to dump the process.
So, the purpose of this tool is to provide an additional attack vector in red team engagements, since many users are using password managers. Three different videos have been uploaded to assist in understanding how this tool works.
Regarding fixing these issues, most vendors responded that such issues are out-of-scope for them since the attacker needs local access or AV/EDR should protect the user against such attacks. Although some products may provide fixes, their exploits will be released at a later date (they are still under disclosure). Two vendors so far have acknowledged this issue and provided fixes with CVE-2023-23349 (Kaspersky) and CVE-2024-9203 (Enpass).
This is not a completely new concept. It has been well-known for some time that there is no de facto way for desktop applications to be protected against such attacks. However, and to the best of my knowledge, this is the first time such a tool has been presented to the public. Feel free to provide any feedback and/or recommendations/improvements. The tool only handles the relevant versions. A password manager update could potentially change the pattern that the tool uses to identify the credentials.
(back to top)
(back to top)
Simply, clone the code, and compile it. For the development phase, Visual Studio 2022 was used.
git clone https://github.com/efchatz/pandora.git
In case of an issue with "DbgHelp.lib", do the following:
(back to top)
The code is structured as follows:
The user chooses the mode (full, fast, local). Full mode will dump all processes from a password manager and fast will dump the most common one that in most cases will contain the credentials. Local mode is done locally while providing the dump file.
The user then has the option to check which password manager is installed for either an app or a plugin with a yes/no choice. The code checks if the default installation path of each password manager exists and provides the output. Note that during installation, most password managers do not allow the user to change the default installation path. For instance, Keeper is installed directly from the MS Store. So, this method could assist in identifying which password manager is installed. Note that in Full mode, the tool will not validate the actual size of each process file that will be created. So, if the host does not have the required free space, some processes will not be dumped and no error message will be shown.
The user chooses the relevant password manager.
If the user chooses the "local" mode, then they will be asked if they want to merge different dump files. If yes, they must provide their filenames, each one per line, and enter "done" at the end. Otherwise, they will only have to provide their dump filename.
Based on the relevant password manager, the tool dumps the process into a file.
The dump file then is analyzed to identify any relevant pattern within it, to extract credentials.
In some cases, some junk data will be presented to the user. These data will be noted as unparsed characters. So, they can be easily recognized.
The user then can identify the credentials (either in the cmd output or in the relevant txt file).
It should be noted that in some cases password managers store in plaintext other types of data, like credit card details, addresses, Wi-Fi passwords etc. Users should be wary of such attacks and should not execute untrusted files, enable 2FA, etc.
Regarding the exploits, the methodology is simple, i.e., the purpose is to identify a pattern or a keyword that would pinpoint the relevant credentials within the dump file. Each password manager is different, so, each exploitation method differs. However, the concept is the same, i.e., finding the relevant pattern can pinpoint the credentials within this file. In some cases, the exploit finds when the credentials start and then gathers the next bytes, say 100. I did some extensive testing to identify these values correctly, but they may differ in a real-case scenario. Open an issue if you want to propose another password manager to be included in this tool which contains credentials in plaintext format within the process.
Note that the tool will delete the relevant 'app.dmp' file at the end of execution. Consider commenting out this line in the code 'remove("app.dmp");', in case you want to keep the relevant dump file. Generally, it is advised to first execute the code in a constrained environment in which the master/entry credentials will be known, observe the relevant output, and then execute it in another host.
Any further details can be found in our research work titled "Keep your memory dump shut: Unveiling data leaks in password managers"
To use this tool, simply execute the compiled executable in the relevant host and type the name of the password manager. Based on the password manager, there are some requirements for the tool to be able to extract credentials. However, I kept in most cases password managers who needed basic interaction to store their credentials in the memory of their process. After executing the tool, it will automatically dump the relevant process based on the chosen password manager, print the credentials in the cmd, and save them into a file (the location of the file is the current folder of the .exe).
Three videos have been uploaded to assist in how this tool works. The videos depict the phase in which an attacker would be able to gather the credentials from a password manager. In the case of Avira and similar password managers, this can be done without any user interaction (check relevant video).
The following table depicts a high-level view of the tool's capabilities. Note that Firefox and the relevant Firefox plugins of password managers may not work correctly. They need further research for the tool to be able to extract the credentials in every case. This is because Firefox changes its pattern with each execution.
Note: The Users column refers to the number of users mentioned in the Chrome Web Store for each browser plugin. The browser plugins were examined with Chrome v129.0.6668.89/.90. Later versions of Chrome may interfere and alter the pattern of each browser plugin.
| Name | Location | Credentials | Browser | Stability | Version | Users |
|---|---|---|---|---|---|---|
| 1Password | App/Plugin | Master(App)/Master(Plugin) | Chrome | Yes | 8.10.44.34 | +5M |
| Avira | Plugin | Entries | Chrome | Yes | 2.21.0.4971 | +6M |
| Bitdefender | Plugin | Master | Chrome | Yes | 1.3.1 | +100K |
| Bitwarden | Plugin | Entries | Chrome | Yes | 2024.10.1 | +4M |
| Bitwarden | App | Master | N/A | Yes | 2024.9.0 | N/A |
| Chromium | Browser | Entries | Chrome/MSEdge/Brave/Opera | Yes | 130.0.6723.59 | N/A |
| Enpass | App | Entries (fixed) | N/A | Yes | 6.9.3 (patched) | N/A |
| Dashlane | Plugin | Master/Entries | Chrome | Yes | 6.2440.1 | +2M |
| Firefox | Browser | Entries | N/A | Partial | 131.0 | N/A |
| Ironvest | Plugin | Entries | Chrome | Yes | 9.9.12 | +90K |
| Kaspersky | Plugin | Entries (fixed) | Chrome | Yes | 24.0.0.427 (patched) | +2M |
| Keeper | App | Master/Entries | N/A | Yes | 16.11.3 | +1M |
| LastPass | Plugin | Master/Entries | Chrome | Yes | 4.134.0 | +9M |
| NordPass | App | Master | N/A | Yes | 5.23.10 | N/A |
| Norton | Plugin | Entries | Chrome | Yes | 8.2.1.388 | +4M |
| Passwarden | App | Entries | N/A | Yes | 3.3.0 | +1K |
| Passwordboss | App | Entries | N/A | Yes | 5.5.5249.0 | +20K |
| Roboform | App/Plugin | Master(Plugin)/Entries(Both) | Chrome | Yes | 9.6.8.0 | +600K |
Regarding the extraction of credentials, some exploits are based on a specific number of bytes, to extract the credentials. So, maybe, in some cases, this number must be increased to extract this information correctly. During the experiments, common usernames and passwords were used. So, in most cases, this would be sufficient.
Another note is relevant to the version of each password manager of a browser plugin. If a change is made in the code and affects the process, the tool may be unable to identify these credentials. So, keep in mind that there is a possibility to mishandle some credentials if an older/newer version of the tool is used, or a different OS is running (tested on Windows 10 Pro).
In most cases, the following will be needed to extract the credentials:
No open issues yet, or sync has not completed.