Browser dump (chrome,firefox) implemented
This commit is contained in:
marcos.luna
@@ -0,0 +1,169 @@
|
||||
# browser_dump - Dump Browser Credentials
|
||||
|
||||
Extract cookies, saved passwords (logins), and bookmarks from web browsers.
|
||||
|
||||
## Description
|
||||
|
||||
The `browser_dump` command extracts encrypted credentials from web browsers and decrypts them using browser-specific methods. It supports **Chrome** and **Firefox** browsers.
|
||||
|
||||
**Important:** Only saved passwords (logins) are automatically reported to Mythic's credential store. Cookies are displayed in the output for manual use but are **NOT** stored as credentials.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
browser_dump <browser>
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
browser_dump chrome
|
||||
browser_dump firefox
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **Browser Support**: Chrome, Firefox
|
||||
- **Credential Extraction**: Cookies (display only), saved passwords, and bookmarks
|
||||
- **Automatic Decryption**: Decrypts browser-protected credentials
|
||||
- **Credential Reporting**: Automatically reports saved passwords to Mythic (cookies are NOT stored)
|
||||
- **Artifact Tracking**: Reports credential access artifacts
|
||||
- **Profile Support**: Firefox supports multiple profiles
|
||||
- **Smart Cookie Filtering**: Only shows session cookies useful for authentication/impersonation (filters out tracking cookies)
|
||||
|
||||
## Output
|
||||
|
||||
The command outputs three sections:
|
||||
|
||||
### Cookies
|
||||
```
|
||||
============================================
|
||||
|| Cookies ||
|
||||
============================================
|
||||
|
||||
- URL: example.com
|
||||
- Path: /
|
||||
- Name: session_id
|
||||
- Cookie: abc123def456...
|
||||
```
|
||||
|
||||
**Note:** Cookies are displayed in the output but are **NOT** saved to Mythic's credential store. They are shown for manual use in session hijacking scenarios.
|
||||
|
||||
### Bookmarks
|
||||
```
|
||||
============================================
|
||||
|| Bookmarks ||
|
||||
============================================
|
||||
|
||||
- Name: GitHub
|
||||
- URL: https://github.com
|
||||
```
|
||||
|
||||
### Saved Logins
|
||||
```
|
||||
============================================
|
||||
|| Saved logins ||
|
||||
============================================
|
||||
|
||||
- URL: https://example.com
|
||||
- Username: user@example.com
|
||||
- Password: mypassword123
|
||||
```
|
||||
|
||||
## Credential Reporting
|
||||
|
||||
**Only saved passwords (logins) are automatically reported to Mythic:**
|
||||
|
||||
- **Passwords**: Reported as `plaintext` credential type
|
||||
- **Realms**: Automatically extracted from URLs (domain names)
|
||||
- **Cookies**: **NOT** stored as credentials (displayed in output only)
|
||||
|
||||
Credentials appear in Mythic's Credentials page (click the key icon in the UI).
|
||||
|
||||
## Cookie Filtering
|
||||
|
||||
The command intelligently filters cookies to show only those useful for authentication and session hijacking:
|
||||
|
||||
- **Chrome**: Only session cookies (no expiration) without security flags (HttpOnly, Secure)
|
||||
- **Firefox**: Session cookies or authentication-related cookies (filters out tracking cookies)
|
||||
|
||||
Tracking cookies and cookies with security flags are excluded from the output.
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Chrome (Chromium-based)
|
||||
|
||||
1. **App-Bound Key Extraction**: Reads `Local State` file and extracts the app-bound encryption key
|
||||
2. **Key Decryption**: Decrypts the app-bound key using DPAPI (as SYSTEM and user)
|
||||
3. **Data Decryption**: Decrypts cookies and passwords using AES-256-GCM
|
||||
4. **Database Access**: Reads SQLite databases (`Cookies`, `Login Data`)
|
||||
|
||||
### Firefox
|
||||
|
||||
1. **Profile Detection**: Reads `profiles.ini` to find all Firefox profiles
|
||||
2. **Database Access**: Directly reads SQLite databases (`cookies.sqlite`, `places.sqlite`, `logins.json`)
|
||||
3. **Password Decryption**: Decrypts saved passwords using master key derivation
|
||||
4. **Cookie Storage**: Firefox stores cookies in plaintext (no decryption needed)
|
||||
|
||||
## File Paths
|
||||
|
||||
### Chrome
|
||||
- Cookies: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies`
|
||||
- Logins: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data`
|
||||
- Bookmarks: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Bookmarks`
|
||||
- Local State: `%LOCALAPPDATA%\Google\Chrome\User Data\Local State`
|
||||
|
||||
### Firefox
|
||||
- Profiles: `%APPDATA%\Mozilla\Firefox\profiles.ini`
|
||||
- Cookies: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\cookies.sqlite`
|
||||
- Logins: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\logins.json`
|
||||
- Bookmarks: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\places.sqlite`
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **HIGH DETECTION RISK**: Browser credential access is heavily monitored
|
||||
- **EDR/XDR Detection**: Most security tools have specific rules for this activity
|
||||
- **File Access Monitoring**: Access to browser databases triggers alerts
|
||||
- **Credential Theft Indicators**: This is a primary indicator of attack (MITRE T1555)
|
||||
- **Elastic Security**: Detects unsigned processes accessing browser stores
|
||||
- **Detection Timeframe**: Detection is likely within minutes
|
||||
|
||||
### Detection Mechanisms
|
||||
|
||||
- File access to browser credential databases
|
||||
- Access to `Local State` files (Chrome)
|
||||
- Access to `profiles.ini` (Firefox)
|
||||
- Behavioral analysis (credential extraction patterns)
|
||||
- Credential theft detection rules
|
||||
|
||||
### Best Practices
|
||||
|
||||
- Use `browser_info` first to identify available browsers
|
||||
- Consider timing (off-hours may reduce detection)
|
||||
- Ensure proper authorization before use
|
||||
- Always requires approval from another operator
|
||||
- Alternative: Manual extraction may have lower detection risk
|
||||
|
||||
## Artifacts
|
||||
|
||||
The command automatically reports the following artifacts:
|
||||
|
||||
- **Credential Access**: Browser credential database access (Cookies, Login Data)
|
||||
- **File Read**: Browser Local State file access (Chrome)
|
||||
- **File Read**: Browser profiles.ini access (Firefox)
|
||||
|
||||
## Related
|
||||
|
||||
[Browser Information Command](browser_info.md) - Identify installed browsers
|
||||
[Credentials Support](../../../features.md#credentials-support)
|
||||
[OPSEC Guide](../../../opsec.md)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** System Operations
|
||||
**Requires Admin:** No (but may need SYSTEM token for Chrome key decryption)
|
||||
**MITRE ATT&CK:** [T1555 - Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/), [T1539 - Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/), [T1081 - Credentials in Files](https://attack.mitre.org/techniques/T1081/)
|
||||
Reference in New Issue
Block a user