keepass_dumper.py

Python port of vdohney/keepass-password-dumper (CVE-2023-32784) — all credit for the original C# implementation and the underlying technique goes to vdohney.

The script scans a process memory dump for the leftover render strings that KeePass 2.x's SecureTextBoxEx leaves behind while the user types the master password, and recovers every character of that password except the first one. Optionally it then brute-forces the unknown first character against a KDBX file using keepassxc-cli.

Affected versions

• Vulnerable: KeePass 2.53.1 and earlier (Windows and Linux).
• Fixed: KeePass 2.54 and later.
• KeePassXC, KeePass 1.x, and Strongbox are not affected.

The flaw is in the custom SecureTextBoxEx control: for each character typed, .NET keeps a residual string in managed memory of the form ●a, ●●s, ●●●s, … from which every password character past the first can be recovered.

Attack prerequisites & limitations

• Requires a memory artifact of the KeePass process: a process dump, the page/swap file, a hibernation file, a kernel crash dump, or a full RAM capture. No code execution on the target host is needed.
• Works whether the workspace is locked or unlocked, and even after the KeePass process has exited (as long as memory pages survive somewhere).
• The very first password character is not recoverable from the leak.
• The leak captures printable ASCII reliably; non-ASCII characters are less reliable.
• Multiple master passwords entered in the same session may produce overlapping leftover strings and degrade accuracy.

Mitigation

If you used KeePass ≤ 2.53.1, assume the master password is compromised:

1. Update KeePass to 2.54 or newer.
2. Change the master password (and rotate any high-value secrets stored in the database that were entered while the old master was in use).
3. Purge memory artifacts that could still contain the leftover strings:
   • delete crash dumps (e.g. C:\Windows\memory.dmp),
   • disable/clear hibernation (powercfg /h off on Windows),
   • delete or wipe the pagefile / swapfile,
   • overwrite free disk space (e.g. cipher /w: on Windows) so the leftovers can't be carved from previously allocated sectors,
   • reboot — or, for high-assurance scenarios, reinstall the OS.

Requirements

• Python 3.10+ (standard library only — no third-party packages)
• keepassxc-cli in $PATH (only needed for --kdbx)

Installation

On Debian / Ubuntu, install the KeePassXC CLI if you plan to brute-force:

sudo apt install keepassxc

Usage

# Recover candidate characters and print them
python3 keepass_dumper.py memory.dmp

# Dump the generated candidate list to a file
python3 keepass_dumper.py memory.dmp -p candidates.txt

# Recover and brute-force the missing first char against a KDBX
python3 keepass_dumper.py memory.dmp --kdbx db.kdbx

Run python3 keepass_dumper.py --help for the full option list.

What's different from the original

• Tighter scan filter (printable ASCII by default) to cut false positives.
• Priority-ordered charset (letters → digits → common punctuation → rest) so the most likely candidates are tried first.
• mmap-based dump reader, single-line progress bar, quieter output.