kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Browser dump (chrome,firefox) implemented

Browse Source
This commit is contained in:
marcos.luna
2025-12-03 09:28:34 +01:00
parent f57850f243
commit e688609c0e
18 changed files with 280387 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation-payload/Cazalla/_index.md
+2 -1
View File
@@ -48,9 +48,10 @@ Cazalla provides essential post-exploitation capabilities including:
- `socks` - Start/stop SOCKS5 proxy
- `rpfwd` - Start/stop reverse port forwarding
### System Operations (5 commands)
### System Operations (6 commands)
- `shell` - Execute shell commands
- `browser_info` - Identify installed browsers
- `browser_dump` - Dump browser credentials
- `screenshot` - Capture desktop screenshot
- `keylog_start` - Start keylogger
- `keylog_stop` - Stop keylogger
documentation-payload/Cazalla/commands.md
+59
View File
@@ -955,6 +955,65 @@ Path: C:\Program Files\Google\Chrome\Application\chrome.exe
---
### `browser_dump` - Dump Browser Credentials
Extract cookies, saved passwords, and bookmarks from web browsers.
**Syntax:**
```
browser_dump <browser>
```
**Parameters:**
- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`
**Examples:**
```
browser_dump chrome
browser_dump firefox
```
**Features:**
- Supports Chrome and Firefox
- Extracts cookies (display only), saved passwords, and bookmarks
- Automatically decrypts browser-protected credentials
- Reports saved passwords to Mythic's credential store (cookies are NOT stored)
- Smart cookie filtering: Only shows session cookies useful for authentication
- HIGH OPSEC RISK: Browser credential access is heavily monitored
**Output:**
```
============================================
|| Cookies ||
============================================
- URL: example.com
- Cookie: session_id=abc123...
============================================
|| Saved logins ||
============================================
- URL: https://example.com
- Username: user@example.com
- Password: mypassword123
```
**Credential Reporting:**
- **Passwords**: Automatically saved to Mythic's credential store
- **Cookies**: Displayed in output but NOT stored as credentials
**OPSEC Considerations:**
- HIGH DETECTION RISK - Browser credential access is heavily monitored
- EDR/XDR solutions have specific detection rules
- File access to browser databases triggers alerts
- Detection is likely within minutes
- Always requires approval from another operator
**Related:** [Browser Information Command](commands/browser_info.md), [Detailed Documentation](commands/browser_dump.md)
---
## Control Commands
### `sleep` - Adjust Beacon Interval
documentation-payload/Cazalla/commands/browser_dump.md
+169
View File
@@ -0,0 +1,169 @@
# browser_dump - Dump Browser Credentials
Extract cookies, saved passwords (logins), and bookmarks from web browsers.
## Description
The `browser_dump` command extracts encrypted credentials from web browsers and decrypts them using browser-specific methods. It supports **Chrome** and **Firefox** browsers.
**Important:** Only saved passwords (logins) are automatically reported to Mythic's credential store. Cookies are displayed in the output for manual use but are **NOT** stored as credentials.
## Syntax
```
browser_dump <browser>
```
## Parameters
- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`
## Examples
```
browser_dump chrome
browser_dump firefox
```
## Features
- **Browser Support**: Chrome, Firefox
- **Credential Extraction**: Cookies (display only), saved passwords, and bookmarks
- **Automatic Decryption**: Decrypts browser-protected credentials
- **Credential Reporting**: Automatically reports saved passwords to Mythic (cookies are NOT stored)
- **Artifact Tracking**: Reports credential access artifacts
- **Profile Support**: Firefox supports multiple profiles
- **Smart Cookie Filtering**: Only shows session cookies useful for authentication/impersonation (filters out tracking cookies)
## Output
The command outputs three sections:
### Cookies
```
============================================
|| Cookies ||
============================================
- URL: example.com
- Path: /
- Name: session_id
- Cookie: abc123def456...
```
**Note:** Cookies are displayed in the output but are **NOT** saved to Mythic's credential store. They are shown for manual use in session hijacking scenarios.
### Bookmarks
```
============================================
|| Bookmarks ||
============================================
- Name: GitHub
- URL: https://github.com
```
### Saved Logins
```
============================================
|| Saved logins ||
============================================
- URL: https://example.com
- Username: user@example.com
- Password: mypassword123
```
## Credential Reporting
**Only saved passwords (logins) are automatically reported to Mythic:**
- **Passwords**: Reported as `plaintext` credential type
- **Realms**: Automatically extracted from URLs (domain names)
- **Cookies**: **NOT** stored as credentials (displayed in output only)
Credentials appear in Mythic's Credentials page (click the key icon in the UI).
## Cookie Filtering
The command intelligently filters cookies to show only those useful for authentication and session hijacking:
- **Chrome**: Only session cookies (no expiration) without security flags (HttpOnly, Secure)
- **Firefox**: Session cookies or authentication-related cookies (filters out tracking cookies)
Tracking cookies and cookies with security flags are excluded from the output.
## Technical Details
### Chrome (Chromium-based)
1. **App-Bound Key Extraction**: Reads `Local State` file and extracts the app-bound encryption key
2. **Key Decryption**: Decrypts the app-bound key using DPAPI (as SYSTEM and user)
3. **Data Decryption**: Decrypts cookies and passwords using AES-256-GCM
4. **Database Access**: Reads SQLite databases (`Cookies`, `Login Data`)
### Firefox
1. **Profile Detection**: Reads `profiles.ini` to find all Firefox profiles
2. **Database Access**: Directly reads SQLite databases (`cookies.sqlite`, `places.sqlite`, `logins.json`)
3. **Password Decryption**: Decrypts saved passwords using master key derivation
4. **Cookie Storage**: Firefox stores cookies in plaintext (no decryption needed)
## File Paths
### Chrome
- Cookies: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies`
- Logins: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data`
- Bookmarks: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Bookmarks`
- Local State: `%LOCALAPPDATA%\Google\Chrome\User Data\Local State`
### Firefox
- Profiles: `%APPDATA%\Mozilla\Firefox\profiles.ini`
- Cookies: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\cookies.sqlite`
- Logins: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\logins.json`
- Bookmarks: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\places.sqlite`
## OPSEC Considerations
- **HIGH DETECTION RISK**: Browser credential access is heavily monitored
- **EDR/XDR Detection**: Most security tools have specific rules for this activity
- **File Access Monitoring**: Access to browser databases triggers alerts
- **Credential Theft Indicators**: This is a primary indicator of attack (MITRE T1555)
- **Elastic Security**: Detects unsigned processes accessing browser stores
- **Detection Timeframe**: Detection is likely within minutes
### Detection Mechanisms
- File access to browser credential databases
- Access to `Local State` files (Chrome)
- Access to `profiles.ini` (Firefox)
- Behavioral analysis (credential extraction patterns)
- Credential theft detection rules
### Best Practices
- Use `browser_info` first to identify available browsers
- Consider timing (off-hours may reduce detection)
- Ensure proper authorization before use
- Always requires approval from another operator
- Alternative: Manual extraction may have lower detection risk
## Artifacts
The command automatically reports the following artifacts:
- **Credential Access**: Browser credential database access (Cookies, Login Data)
- **File Read**: Browser Local State file access (Chrome)
- **File Read**: Browser profiles.ini access (Firefox)
## Related
[Browser Information Command](browser_info.md) - Identify installed browsers
[Credentials Support](../../../features.md#credentials-support)
[OPSEC Guide](../../../opsec.md)
---
**Command Category:** System Operations
**Requires Admin:** No (but may need SYSTEM token for Chrome key decryption)
**MITRE ATT&CK:** [T1555 - Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/), [T1539 - Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/), [T1081 - Credentials in Files](https://attack.mitre.org/techniques/T1081/)
documentation-payload/Cazalla/examples.md
+3
View File
@@ -43,6 +43,9 @@ ps
# Identify installed browsers
browser_info
# Dump browser credentials (requires approval)
browser_dump chrome
# Check current directory contents
ls C:\Users
```
documentation-payload/Cazalla/features.md
+36 -1
View File
@@ -466,6 +466,41 @@ Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
For detailed information, see [browser_info command documentation](commands/browser_info.md).
#### `browser_dump`
Extracts cookies, saved passwords, and bookmarks from web browsers.
**Supported Browsers:**
- Google Chrome
- Mozilla Firefox
**Extracted Data:**
- Cookies with decrypted values (display only, NOT stored as credentials)
- Saved passwords (logins) with usernames
- Bookmarks with URLs
**Credential Reporting:**
- **Passwords**: Automatically saved to Mythic's credential store as `plaintext` credential type
- **Cookies**: Displayed in output but NOT stored as credentials (for manual use only)
- Realms automatically extracted from URLs
**Cookie Filtering:**
- Only shows session cookies useful for authentication/impersonation
- Filters out tracking cookies and cookies with security flags
**OPSEC Considerations:**
- HIGH DETECTION RISK - Browser credential access is heavily monitored
- EDR/XDR solutions have specific detection rules
- File access to browser databases triggers alerts
- Always requires approval from another operator
**Example:**
```
browser_dump chrome
```
For detailed information, see [browser_dump command documentation](commands/browser_dump.md).
---
## OPSEC Checking
@@ -486,7 +521,7 @@ Cazalla includes comprehensive OPSEC Checking functionality that provides operat
### Commands with OPSEC Checking
- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files)
- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files), `browser_dump`
- **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, `browser_info`, etc.
### Bypass Roles
documentation-payload/Cazalla/getting-started.md
+6
View File
@@ -149,6 +149,12 @@ browser_info
This identifies installed web browsers and the default browser.
```
browser_dump chrome
```
This extracts cookies, saved passwords, and bookmarks from Chrome (requires approval).
```
whoami
```
documentation-payload/Cazalla/opsec.md
+5
View File
@@ -350,6 +350,11 @@ Built-in Cazalla commands:
- **Detection**: Registry reads may be logged if auditing enabled
- **Best Practice**: Read-only operation, safe for information gathering
#### `browser_dump`
- **Risk**: HIGH
- **Detection**: Browser credential access is heavily monitored by EDR/XDR
- **Best Practice**: Use only when necessary, always requires approval, consider timing
#### `screenshot`
- **Risk**: HIGH
- **Detection**: Screen capture detection, behavioral analysis