Password Manager
In this section we’ll demonstrate a very common penetration test scenario.
Let’s assume we have gained access to a client workstation
running a password manager.
In the following demonstration, we’ll extract the password manager’s database,
transform the file into a format usable by Hashcat,
and crack the master database password.
Let’s begin by connecting to the target machine over RDP.
Assuming we’ve obtained credentials for the jason user (lab), we’ll log in.
And after a successful connection, we’ll gain access to the system desktop.
Once connected, we’ll check which programs are installed on the system.
There are many ways to search for installed programs,
but since we have GUI access,
we’ll use the Apps & features function of Windows,
which is the most straight-forward approach.
We’ll click on the Windows icon,
type “Apps”,
select Add or remove programs
and scroll down to review all installed programs.
The list shows us that KeePass is installed on the system.
If we were unfamiliar with this program, we would research it,
eventually discovering that the KeePass database is stored as a .kdbx file,
and that there may be more than one database on the system.
For example, a user may maintain a personal database
and an organization may maintain a department-level database.
Our next step is to locate the database files
by searching for all .kdbx files on the system.
Let’s use PowerShell with the _Get-ChildItem cmdlet
to find files in specified locations.
We’ll use Path to search the whole drive.
Next, we’ll use -Include to specify the file types we want to include,
As well as -File and -Recurse arguments
to get a list of files and search in subdirectories.
Finally we’ll set -ErrorAction to SilentlyContinue
to silence errors and continue execution.
The output reveals a database file in the jason user’s Documents folder.
We’ll transfer this file to a share on our Kali system
in preparation for the following steps.
We have now completed the first step of the cracking methodology
and can proceed to the next step,
transforming the hash into a format our cracking tool can use.
The JtR suite includes various transformation scripts
like ssh2john and keepass2john,
which can format a broad range of different file formats,
and they are installed by default on our Kali machine.
We can also use these scripts to format hashes for Hashcat.
Let’s use the keepass2john script to format the database file
and save the output to keepass.hash.
The output shows the resulting hash of the KeePass database stored in keepass.hash.
Before we can work with the resulting hash, we need to further modify it.
In our case, the JtR script prepended the filename Database to the hash.
The script does this to act as the username for the target hash.
This is helpful when cracking database hashes, since we want the output
to contain the corresponding username and not only the password.
Since KeePass uses a master password without any kind of username,
we need to remove the “Database:” string with a text editor.
After removing the “Database:” string the hash is in the correct format for Hashcat:
We’re nearly ready to start the cracking process,
but we need to determine the hash type for KeePass.
We could look it up in the Hashcat Wiki, or grep the hashcat help output.
The output of the grep command shows that the correct mode for KeePass is 13400.
Let’s skip step three (cracking time calculation)
since this is a simple example and won’t take long,
and move on to step four to prepare our wordlist.
We’ll use one of the Hashcat-provided rules, as mentioned earlier,
combined with the rockyou wordlist.
This rule file is especially effective with rockyou, since it was created for it.
As we enter step five, we’ve prepared everything for our password attack.
After several seconds Hashcat successfully cracked the hash,
and discovered the KeePass master password.
Let’s run KeePass over our RDP connection and when prompted, enter the password.
Very nice!
We opened KeePass with the cracked password.
Now we have access to all the user’s stored passwords!