Loadpedia586

To crack a password-only database, use mod0keecrack like this: mod0keecrack wordlist.txt To crack a database that also uses a key-file, use the command line as shown above, and copy the keyfile to the same directory as the database and rename it to.key. The database is encrypted with AES and Twofish algorithms, secured and locked with one master key or a key file, so that users just have to remember one single master password or select the key file to unlock the whole database. While KeePass Password Safe is a fine, good password manager, with one issue.

We see a lot of KeePass usage while on engagements. In the corporate environments we operate in, it appears to be the most common password manager used by system administrators. We love to grab admins’ KeePass databases and run wild, but this is easier said than done in some situations, especially when key files (or Windows user accounts) are used in conjunction with passwords. This post will walk through a hypothetical case study in attacking a KeePass instance that reflects implementations we’ve encountered in the wild.

First Steps

First things first: you need a way to determine if KeePass is running, and ideally what the version is. The easiest way to gather this information is a simple process listing, through something like Cobalt Strike or PowerShell:

Now it helps to know where the Keepass binary is actually located. By default the binary is located in C:Program Files (x86)KeePass Password Safefor KeePass 1.X and C:Program Files (x86)KeePass Password Safe 2 for version 2.X, but there’s also a portable version that can be launched without an install. Luckily we can use WMI here, querying for win32_processes and extracting out the ExecutablePath:

Get-WmiObjectwin32_process|Where-Object{$_.Name-like‘*kee*’}|Select-Object-ExpandExecutablePath

If KeePass isn’t running, we can use PowerShell’s Get-ChildItem cmdlet to search for the binary as well as any .kdb[x] databases:

Get-ChildItem-PathC:Users-Include@(“*kee*.exe”,“*.kdb*”)-Recurse-ErrorActionSilentlyContinue|Select-Object-ExpandFullName|fl

Attacking the KeePass Database

We’ll sometimes grab the KeePass binary itself (to verify its version) as well as any .kdb (version 1.X) or .kdbx (version 2.X) databases. If the version is 2.28, 2.29, or 2.30 and the database is unlocked, you can use denandz‘ KeeFarce project to extract passwords from memory; however, this attack involves dropping multiple files to disk (some of which are now flagged by antivirus). You could also try rolling your own version to get by the AV present on the system or disabling AV entirely (which we don’t really recommend). I’m not aware of a memory-only option at this point.

We generally take a simpler approach- start a keylogger, kill the KeePass process, and wait for the user to input their unlock password. We may also just leave the keylogger going and wait for the user to unlock KeePass at the beginning of the day. While it’s possible for a user to set the ‘Enter master key on secure desktop’ setting which claims to prevent keylogging, according to KeePass this option “is turned off by default for compatibility reasons“. KeePass 2.X can also be configured to use the Windows user account for authentication in combination with a password and/or keyfile (more on this in the DPAPI section).

If you need to crack the password for a KeePass database, HashCat 3.0.0 (released 6/29/16) now includes support for KeePass 1.X and 2.X databases (-m 13400). As @Fist0ursdetails, you can extract a HashCat-compatible hash from a KeePass database using the keepass2john tool from the John The Ripper suite, which was written by Dhiru Kholia and released under the GPL. Here’s what the output looks like for a default KeePass 2.X database with the password of ‘password’:

This worked great, but I generally prefer a more portable solution in Python for these types of hash extractors. I coded up a quick-and-dirty Python port of Dhiru’s code on a Gist here (it still needs more testing and keyfile integration).

Here’s the output for the same default database:

KeePass.config.xml

More savvy admins will use a keyfile as well as a password to unlock their KeePass databases. Some will name this file conspicuously and store in My Documents/Desktop, but other times it’s not as obvious.

Luckily for us, KeePass nicely outlines all the possible configuration file locations for 1.X and 2.xhere. Let’s take a look at what a sample 2.X KeePass.config.xml configuration looks like (located at C:UsersuserAppDataRoamingKeePassKeePass.config.xml or in the same folder as a portable KeePass binary):

The XML config nicely tells us exactly where the keyfile is located. If the admin is using their “Windows User Account” to derive the master password (<UserAccount>true</UserAccount> under <KeySources>) see the DPAPI section below. If they are even more savvy and store the key file on a USB drive not persistently mounted to the system, check out the Nabbing Keyfiles with WMI section.

DPAPI

Setting ‘UserAccount’ set to true in a KeePass.config.xml means that the master password for the database includes the ‘Windows User Account’ option. KeePass will mix an element of the user’s current Windows user account in with any specific password and/or keyfile to create acomposite master key. If this option is set and all you grab is a keylogged password and/or keyfile, it might seem that you’re still out of luck. Or are you?

In order to use a ‘Windows User Account’ for a composite key in a reasonably secure manner, KeePass takes advantage of the Windows Data Protection Application Programming Interface(DPAPI). This interface provides a number of simple cryptographic calls (CryptProtectData()/CryptUnProtectData()) that allow for easy encryption/decryption of sensitive DPAPI data “blobs”. User information (including their password) is used to encrypt a user ‘master key’ (located at %APPDATA%MicrosoftProtect<SID>) that’s then used with optional entropy to encrypt/decrypt application-specific blobs. The code and entropy used by KeePass for these calls is outlined in the KeePass source and the KeePass specific DPAPI blob is kept at%APPDATA%KeePassProtectedUserKey.bin.

Fortunately, recovering a KeePass composite master key with a Windows account mixin is a problem several people have encountered before. The KeePass wiki even has a nice writeup on the recovery process:

• Copy the target user account DPAPI master key folder from C:Users<USER>AppDataRoamingMicrosoftProtect<SID> . The folder name will be a SID (S-1-…) pattern and contain a hidden Preferred file and master key file with a GUID naming scheme.
• Copy C:Users<USER>AppDataRoamingKeePassProtectedUserKey.bin . This is the protected KeePass DPAPI blob used to create the composite master key.
• Take note of the username and userdomain of the user who created the KeePass database as well as their plaintext password.
• Move the <SID> folder to %APPDATA%MicrosoftProtect on an attacker controlled Windows machine (this can be non-domain joined).
• Set a series of registry keys under HKCU:SOFTWAREMicrosoftWindows NTCurrentVersionDPAPIMigratedUsers , including the old user’s SID, username, and domain. The KeePass wiki has a registry template for this here.
• Run C:Windowssystem32dpapimig.exe, the “Protected Content Migration” utility, entering the old user’s password when prompted.
• Open KeePass 2.X, select the stolen database.kdbx, enter the password/keyfile, and check “Windows User Account” to open the database.

The Restore-UserDPAPI.ps1 PowerShell Gist will automate this process, given the copied SID folder with the user’s master key, original username/userdomain, and KeePass ProtectedUserKey.bin :

If you’re interested, more information on DPAPI is available in @dfirfpi‘s 2014 SANS presentationand post on the subject. Jean-Michel Picod and Elie Bursztein presented research on DPAPI and its implementation in their “Reversing DPAPI and Stealing Windows Secrets Offline” 2010 BlackHat talk. The dpapick project (recently updated) allows for decryption of encrypted DPAPI blobs using recovered master key information. Benjamin Delpy has also done a lot ofphenomenal work in this area, but we still need to take the proper deep dive into his code that it deserves. We’re hoping we can use Mimikatz to extract the DPAPI key and other necessary data from a host in one swoop, but we haven’t worked out that process yet.

[Edit 7/1/16]Tal Be’ery also alerted me to @ItaiGrady‘s great talk, “Protecting browsers’ secrets in a domain environment” (slides here and video here).

Nabbing Keyfiles with WMI

Cracking Keepass Password Safe Database Version

Matt Graeber gave a great presentation at BlackHat 2015 titled “Abusing Windows Management Instrumentation (WMI) to Build a Persistent, Asynchronous, and Fileless Backdoor” (slides hereand whitepaper here). He released the PoC WMI_Backdoor code on GitHub.

One of the WMI events Matt describes is the extrinsic Win32_VolumeChangeEvent which fires every time a USB drive is inserted and mounted. The ‘InfectDrive’ ActiveScriptEventConsumer in Matt’s PoC code shows how to interact with a mounted drive letter with VBScript. We can take this approach to clone off the admin’s keyfile whenever his/her USB is plugged in.

We have two options, one that persists between reboots and one that runs until the powershell.exe process exits. For the non-reboot persistent option, we can use Register-WmiEvent and Win32_VolumeChangeEvent to trigger a file copy action for the known key path:

Register-WmiEvent-Query‘SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2’-SourceIdentifier‘DriveInserted’-Action{$DriveLetter=$EventArgs.NewEvent.DriveName;if(Test-Path“$DriveLetterkey.jpg”){Copy-Item“$DriveLetterkey.jpg”“C:Temp”-Force}}

This trigger will clone the target file into C:Temp whenever the drive is inserted. You can also register to monitor for events on remote computers (assuming you have the appropriate permissions) with -ComputerName and an optional -Credential argument.

For reboot persistence we can easily add a new action to the New-WMIBackdoorAction function in Matt’s WMI_Backdoor code:

2 4 6 8 10 12 14 16 18 20

$VBScript=@” Set oFSO = CreateObject(“Scripting.FileSystemObject”) sFilePath = TargetEvent.DriveName & “key.jpg” If oFSO.FileExists(sFilePath) Then “@ if($ActionName){ }else{ }

We can then register the trigger and action for the backdoor with:

Register-WMIBackdoor-Trigger$(New-WMIBackdoorTrigger-DriveInsertion)-Action$(New-WMIBackdoorAction-FileClone)

Cleanup takes a few more commands:

2

Get-WmiObject-Namespace“rootsubscription”-Class“__FilterToConsumerBinding”|Where-Object{$_.Filter-like“*DriveInsertionTrigger*”}|Remove-WmiObject Get-WmiObject-Namespace“rootsubscription”-Class“__EventFilter”|Where-Object{$_.Name-eq“DriveInsertionTrigger”}|Remove-WmiObject Get-WmiObject-Namespace“rootsubscription”-Class‘ActiveScriptEventConsumer’|Where-Object{$_.Name-eq“FileClone”}|Remove-WmiObject

Big thanks to Matt for answering my questions in this area and pointing me in the right direction.

Keyfiles on Network Mounted Drives

Occasionally users will store their keyfiles on network-mounted drives. PowerView’s new Get-RegistryMountedDrive function lets you enumerate network mounted drives for all users on a local or remote machine, making it easier to figure out exactly where a keyfile is located:

Wrapup

Using KeePass (or another password database solution) is significantly better than storing everything in passwords.xls, but once an attacker has administrative rights on a machine it’s nearly impossible to stop them from grabbing the information they want from the target. With a few PowerShell one-liners and some WMI, we can quickly enumerate KeePass configurations and set monitors to grab necessary key files. This is just scratching the surface of what can be done with WMI- it would be easy to add functionality that enumerates/exfiltrates any interesting files present on USB drives as they’re inserted.

Review1 Screenshots

No review

No VideoPlease select a download mirror:

Where Is My Keepass Database

External Mirror 1

KeePass is a free and open-source password manager that allows you to safely store all of your passwords in a single place and only need to remember a single one - the master password, or unlock the password database with a key file. KeePass...full software details

If you encounter any problems in accessing the download mirrors for KeePass Password Safe, please check your firewall settings or close your download manager.

KeePass Password Safe is offered as a free download

Faster PC? Get Advanced SystemCare and optimize your PC.

WebPassBooster 3.1.5.0
Advanced PassGen 1.7.1.0
Ascendo DataVault 6.2.7

Keepass Password Safe 2.40

Password Helper 1.35

Keepass Password Safe Cnet

Recover Keepass Database