Package: ctfcred
ctfcredDuringCTFsit is common to obtain several different usernames and passwords.
Just storing these inside of text files becomes confusing very quickly and accessing
them in this way is not really fast.ctfcredis designed to allow fast, organized and
simple access toCTFcredentials. Credentials are stored as plaintext in a.ymlfile and are accesses viarofi.Do not use this tool to store real sensitive data!Table of ContentsInstallationUsageUpdating and Cloning CredentialsImport and ExportDefault ValuesWarningInstallationctfcredcan be build and installed as apip package. The following command installsctfcredfor your current user profile:$gitclonehttps://github.com/qtc-de/ctfcred$cdctfcred$python3setup.pysdist$pip3installdist/*ctfcredalso supports autocompletion forbash. To take advantage of autocompletion, you need to have thecompletion-helpersproject installed. If setup correctly, just
copying thecompletion scriptto your~/.bash_completion.dfolder enables
autocompletion.$cpresources/bash_completion.d/ctfcred~/bash_completion.d/Furthermore, there are some external dependencies:rofi(required): a working installation ofrofiis required, asrofiis used to display and access the stored
credentials.libnotifyand anotification server(optional): These are shipped per default on most
distributions. Just type$ notify-send testto check if they are available.
If not, read aboutdesktop notificationsand decide if you want to install them.ctfcreduses the notification server to display messages,
which values were copied to the clipboard. It is nice to have, but not required.UsageThe first thing you probably want to do withctfcredis to add some credentials. Credentials can be added
by using the following argument format:[qtc@kali ~]$ctfcred<USERNAME><PASSWORD><NOTE>Each of this values is optional. You do not have to specify apasswordor anoteand you can use empty strings
forusernameorpasswordto get to the next argument. Let's add some credentials:[qtc@kali ~]$ctfcredtimmypassword123'Found on SMB share 10.10.10.3'[qtc@kali ~]$ctfcredcarolcarolsSecurePassword'Carols AD Credentials'--domainexample.com--url'\\10.10.10.2'[qtc@kali ~]$ctfcredpeterpet3rRul35'Peters GitLab password'--url'https://gitlab.example.com'--otpe1euj1ßdhsdhdasd1[qtc@kali ~]$ctfcredpeterTheInsaneFightersecurePassword'Peters Gaming password'--url'https://games.example.com'--aliaspeter_gamingAfter running the above commands, a plain run ofctfcred(without any arguments) startsrofiand displays the following
view:Withinrofi,ctfcreddefines several keybindings for performing actions with the stored credentials.Ctrl+C:    Copy UsernameCtrl+c:    Copy PasswordCtrl+o:    Copy OTP ValueCtrl+l:    Copy URL ValueCtrl+D:    Copy DomainCtrl+F:    Copy User with DomainCtrl+X:    Delete CredentialCtrl+K:    Move Credential one UpCtrl+J:    Move Credential one DownUpdating and Cloning CredentialsCredentials can be updated or cloned by using the--updateor--clonecommand line switches. Both of these
operations expect you to enter some credential data as in the case of creating a new credential. However, instead of using
the data to add a new credential,ctfcredwill display all available credentials inrofiand wait for you to select one.In the case of--update, the corresponding credential is updated with the data you have entered. In the case of--clonethe credential is cloned and updated with the new data afterwards. Cloning a credential without updating one of it's properties
is not possible, as only unique credentials are allowed byctfcred.The update and clone operations only change data that is user specified and not empty. E.g. if you want to update the password
of a credential without changing it's username, you would run the following command:[qtc@kali ~]$ctfcred''newpassword--updateImport and Exportctfcredstores credentials in a plain text.ymlfile within your home directory (~/.ctfcred.yml). Copying this file to
a different machine is sufficient to export all of your stored credentials.Apart from thectfcredinternal format of storing credentials, it is also possible to export or import credentials from other formats.
DuringCTFsit is quite common to obtain credential lists with in<USERNAME>:<PASSWORD>format. Such a list can be imported with
one of the following commands:[qtc@kali ~]$catcred_file.txtalex:S3cur3P@55w0rdtimmy:insecurePassword:([qtc@kali ~]$ctfcred--import-user-passcred_file.txt[qtc@kali ~]$catcred_file2.txtexample.com/alex:S3cur3P@55w0rdexample.org/timmy:insecurePassword:([qtc@kali ~]$ctfcred--import-user-pass-domaincred_file2.txt[qtc@kali ~]$catcred_file3.txtexample.com/alex,S3cur3P@55w0rdtimmy,insecurePassword:([qtc@kali ~]$ctfcred--import-user-pass-domaincred_file3.txt--sep,In the second and third example, the--import-user-pass-domainoption is required, as otherwise the domain prefix
would be interpreted as username. Apart from imports with usernames and passwords,ctfcredalso allows to import
just usernames or passwords:[qtc@kali ~]$catusers.txttimmyharry[qtc@kali ~]$ctfcred--import-userusers.txt[qtc@kali ~]$catpasswords.txtSecurePW!MySecretPW.[qtc@kali ~]$ctfcred--import-passpasswords.txtExports can be created in a similar way as imports and the same formats are supported. To create a list of username and passwords
separated by:you could run the following command:[qtc@kali ~]$ctfcred--users-passcarol:carolsSecurePasswordpeter:pet3rRul35peterTheInsaneFighter:securePasswordtimmy:password123It is also possible to print all permutations of the stored credentials by using the--mixswitch:[qtc@kali ~]$ctfcred--users-pass--mixcarol:carolsSecurePasswordcarol:password123carol:pet3rRul35carol:securePasswordpeter:carolsSecurePasswordpeter:password123peter:pet3rRul35peter:securePasswordpeterTheInsaneFighter:carolsSecurePasswordpeterTheInsaneFighter:password123peterTheInsaneFighter:pet3rRul35peterTheInsaneFighter:securePasswordtimmy:carolsSecurePasswordtimmy:password123timmy:pet3rRul35timmy:securePasswordFor creating simple wordlist of all available usernames or passwords, the--usersand--passwordsswitches are sufficient:[qtc@kali ~]$ctfcred--userscarolpeterpeterTheInsaneFightertimmy[qtc@kali ~]$ctfcred--passwordscarolsSecurePasswordpassword123pet3rRul35securePasswordDefault ValuesDefault values are currently supported for theurlanddomainattribute of credentials. Both are set toNoneby default,
but they can be set to individual values on the command line:[qtc@kali ~]$ctfcred--default-urlhttps://example.com[qtc@kali ~]$ctfcred--default-domainexample.comWhen setting them manually, each copy or export operation that involves one of the corresponding attributes will use the default value,
when the credential does not has it set explicitly. The following output shows an example of this situation:[qtc@kali ~]$ctfcred--users-domainexample.com/timmytest.org/jamesWarningThis tool should not be used to store any sensitive information like your private usernames or passwords.
As mentioned above, all entered credentials are saved as plaintext on your disk. This behavior is insecure
and should only be used to store non sensitive data, like credentials obtained during aCTF.Copyright 2021, Tobias Neitzel and thectfcredcontributors.