firefox dump working

2025-12-02 11:58:59 +01:00
parent c8fff22a64
commit f57850f243
15 changed files with 737 additions and 4 deletions
@@ -48,8 +48,9 @@ Cazalla provides essential post-exploitation capabilities including:
 - `socks` - Start/stop SOCKS5 proxy
 - `rpfwd` - Start/stop reverse port forwarding

-### System Operations (4 commands)
+### System Operations (5 commands)
 - `shell` - Execute shell commands
+- `browser_info` - Identify installed browsers
 - `screenshot` - Capture desktop screenshot
 - `keylog_start` - Start keylogger
 - `keylog_stop` - Stop keylogger
@@ -35,9 +35,12 @@ Complete documentation for all Cazalla agent commands, organized by category.
 ## System Operations

 - [`shell`](shell.md) - Execute shell commands
+- [`browser_info`](browser_info.md) - Identify installed browsers
+- [`browser_dump`](browser_dump.md) - Dump browser credentials
 - [`screenshot`](screenshot.md) - Capture desktop screenshot
 - [`keylog_start`](keylog_start.md) - Start keylogger
 - [`keylog_stop`](keylog_stop.md) - Stop keylogger
+- [`browser_info`](browser_info.md) - Identify installed browsers

 ## Control Commands

@@ -0,0 +1,95 @@
+# browser_info - Identify Installed Browsers
+
+Identify installed web browsers and the default browser on the target system.
+
+## Description
+
+The `browser_info` command identifies all installed web browsers on the target system and determines the default browser. It checks for common browsers including Chrome, Edge, Firefox, Opera, and Brave, displaying their installation paths and version information.
+
+## Syntax
+
+```
+browser_info
+```
+
+## Parameters
+
+This command does not accept any parameters.
+
+## Examples
+
+```
+browser_info
+```
+
+## Features
+
+- Detects multiple browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave
+- Displays installation paths for each detected browser
+- Shows version information when available
+- Identifies the system's default browser
+- Read-only operation - does not modify system state
+- Low detection risk - only reads registry and file system
+
+## Output
+
+```
+=== Installed Browsers ===
+
+[1] Google Chrome
+    Path: C:\Program Files\Google\Chrome\Application\chrome.exe
+    Version: 120.0.6099.109.0
+
+[2] Microsoft Edge
+    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+    Version: 120.0.2210.91.0
+
+[3] Mozilla Firefox
+    Path: C:\Program Files\Mozilla Firefox\firefox.exe
+    Version: 121.0.0.0
+
+=== Default Browser ===
+
+Name: Google Chrome
+Path: C:\Program Files\Google\Chrome\Application\chrome.exe
+```
+
+## Detection Methods
+
+The command uses the following methods to identify browsers:
+
+1. **File System Checks**: Checks common installation paths for browser executables
+2. **Registry Queries**: Reads registry keys to determine default browser associations
+3. **Version Information**: Extracts version data from executable files when available
+
+### Registry Keys Accessed
+
+- `HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice`
+- `HKEY_CLASSES_ROOT\http\shell\open\command`
+
+## OPSEC Considerations
+
+- **Low Detection Risk**: Read-only operations are rarely flagged by security tools
+- **Registry Reads**: May be logged if registry auditing is enabled
+- **File System Access**: File existence checks may be logged if file auditing is enabled
+- **No Process Creation**: Does not spawn any processes
+- **No Network Activity**: Does not create network connections
+- **No File Modifications**: Does not modify any files or registry keys
+
+## Artifacts
+
+The command automatically reports the following artifacts:
+
+- **Registry Read**: Browser registry keys accessed
+- **File Read**: Browser installation paths checked
+
+## Related
+
+[System Information Gathering](../../../features.md#system-information-gathering)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1082 - System Information Discovery](https://attack.mitre.org/techniques/T1082/), [T1518 - Software Discovery](https://attack.mitre.org/techniques/T1518/)
+
@@ -40,6 +40,9 @@ ls
 # List running processes
 ps

+# Identify installed browsers
+browser_info
+
 # Check current directory contents
 ls C:\Users
 ```
@@ -22,6 +22,7 @@ This document provides detailed explanations of Cazalla's key features and capab
 - [Keylogging Support](#keylogging-support)
 - [File Downloads Support](#file-downloads-support)
 - [File Uploads Support](#file-uploads-support)
+- [System Information Gathering](#system-information-gathering)
 - [OPSEC Checking](#opsec-checking)

 ---
@@ -405,6 +406,68 @@ Cazalla supports uploading files from the Mythic server to the target using chun

 ---

+## System Information Gathering
+
+Cazalla includes commands for gathering system information with low detection risk.
+
+### Features
+
+- **Browser Detection**: Identify installed web browsers and default browser
+- **Read-Only Operations**: No system modifications, minimal detection risk
+- **Version Information**: Extract version details from browser executables
+- **Registry Queries**: Query Windows registry for browser associations
+
+### Commands
+
+#### `browser_info`
+
+Identifies all installed web browsers on the target system and determines the default browser.
+
+**Supported Browsers:**
+- Google Chrome
+- Microsoft Edge
+- Mozilla Firefox
+- Opera
+- Brave
+
+**Output Includes:**
+- Installation paths for each detected browser
+- Version information (when available)
+- Default browser identification
+
+**OPSEC Considerations:**
+- Low detection risk - read-only operations
+- Registry reads may be logged if auditing enabled
+- No process creation or network activity
+- No file modifications
+
+**Example:**
+```
+browser_info
+```
+
+**Output:**
+```
+=== Installed Browsers ===
+
+[1] Microsoft Edge
+    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+    Version: 142.0.3595.94
+
+[2] Mozilla Firefox
+    Path: C:\Program Files\Mozilla Firefox\firefox.exe
+    Version: 145.0.1.627
+
+=== Default Browser ===
+
+Name: Microsoft Edge
+Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+```
+
+For detailed information, see [browser_info command documentation](commands/browser_info.md).
+
+---
+
 ## OPSEC Checking

 Cazalla includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks.
@@ -424,7 +487,7 @@ Cazalla includes comprehensive OPSEC Checking functionality that provides operat
 ### Commands with OPSEC Checking

 - **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files)
- **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, etc.
+- **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, `browser_info`, etc.

 ### Bypass Roles

@@ -143,6 +143,12 @@ ps

 This lists all running processes and updates the Process Browser.

+```
+browser_info
+```
+
+This identifies installed web browsers and the default browser.
+
 ```
 whoami
 ```
@@ -345,6 +345,11 @@ Built-in Cazalla commands:
 - **Detection**: cmd.exe spawn is highly monitored
 - **Best Practice**: Use only when no alternative exists, always requires approval

+#### `browser_info`
+- **Risk**: LOW
+- **Detection**: Registry reads may be logged if auditing enabled
+- **Best Practice**: Read-only operation, safe for information gathering
+
 #### `screenshot`
 - **Risk**: HIGH
 - **Detection**: Screen capture detection, behavioral analysis