Hacking Windows 10: How to Steal & Decrypt Passwords Stored in Chrome & Firefox Remotely « Null Byte :: WonderHowTo

Passwords stored in web browsers like Google Chrome and Mozilla Firefox are a gold mine for hackers. An attacker with backdoor access to a compromised computer can easily dump and decrypt data stored in web browsers. So, you'll want to think twice before hitting "Save" next time you enter a new password.Witha backdoor established on a target computer, hackers can perform a variety of covert attacks. It's possible tocapture every keystroke typedon the computer,capture screenshots, and listen to audio through the microphone. In this article, we'll focus on how hackers can acquire your passwords stored in web browsers.Don't Miss:How to Break into Somebody's Windows 10 Computer Without a PasswordAfter a hacker hasset up their payloadandexploited the systemof their choosing, in our case, aWindows 10system, they can begin their post-exploitation attacks to hunt down passwords in Google Chrome and Mozilla Firefox, which are often regarded as being thebest and most popularweb browsers available. Microsoft Edge only accounts for about 4% of browsers out there, so it's not worth the trouble.Dumping Google Chrome PasswordsChrome utilizes a Windows function calledCryptProtectDatato encrypt passwords stored on computers with a randomly generated key. Only a user with the same login credential as the user who encrypted the data can later decrypt the passwords. Every password is encrypted with a different random key and stored in a small database on the computer. The database can be found in the below directory.Don't Miss:Cryptography Basics for the Aspiring Hacker%LocalAppData%\Google\Chrome\User Data\Default\Login DataNext, we'll use aMetasploitmodule that's designed to dump passwords stored in the Chrome browser. To dump stored Chrome passwords on the target device, use theenum_chromemodule as shown in the below command. This module will collect user data from Google Chrome and attempt to decrypt sensitive information.run post/windows/gather/enum_chromeThe decrypted Chrome browser passwords will be automatically saved to the /root/.msf4/loot/ directory. The newly created .txt file containing the passwords will also be automatically named using the current date and the target user's IP address.Don't Miss:Getting Started with MetasploitTo view the Chrome passwords in the .txt file, first, use thebackgroundcommand to suppress themeterpretershell, then use thecatcommand as shown in the below screenshot. Make sure to swap out the file name with the correct one. The "Decrypted Data" column will display decrypted passwords found in the browser.backgroundcat /root/.msf4/loot/2018..._default_..._chrome.decrypted_xxxxx.txtDon't Miss:How to Hack Web Browsers with BeEFDumping Mozilla Firefox PasswordsThe Firefox built-in password manager stores the encrypted credentials in a file called "logins.json." The usernames and passwords stored in the logins.json file are encrypted with a key that is stored in the "key4.db" file. Both the logins.json and key4.db files can be located in the below Windows directory. The 8-characterrandomStringis assigned to the directory automatically by Firefox when it's first opened on the computer, and the random strings differ for every installation.%LocalAppData%\Mozilla\Firefox\Profiles\randomString.Default\logins.jsonTo dump stored Firefox passwords on a compromised computer, use thefirefox_credsmodule.run post/multi/gather/firefox_credsUse thebackgroundcommand to temporarily move the meterpreter session to the background, and thecdcommand to change into the loot directory. Then, make a new directory called "Profiles" using themkdircommand.Looking back at the dumped data, you will probably notice all of the files were automatically saved as a ".bin" filetype. These files need to be manually moved and renamed to match their original names highlighted on the left side of the screenshot. For example, the "cert_501854.bin" file needed to be moved to the Profiles directory and renamed to "cert9.db." The belowmvcommand can be used to rename files.Don't Miss:How to Crack Passwords Like a Promvcertfilehere.binProfiles/cert9.dbThis will need to happen with the remaining files in the loot directory.With all that taken care of, clone thefirefox_decryptGitHub repository which can be used to decrypt the passwords stored on the logins.json file. Use the below command to clone firefox_decrypt.git clone https://github.com/Unode/firefox_decrypt.gitThe below command can be used to decrypt Firefox passwords stored in the logins.json file. The script will request a "Master Password," but this can be bypassed by leaving the field empty and pressingenter.python firefox_decrypt/firefox_decrypt.py /root/.msf4/loot/How to Protect Against Password DumpingStoring sensitive data in a browser password manager is generally a terrible idea. Unfortunately, there isn't much to be done in terms ofpreventingsuch password dumping attacks aside from just making sure you don't ever save any login credentials in your browser and delete the ones that are already there.You could use a password manager like LastPass, but if a hacker has exploited your system with a backdoor, they could also use akeyloggerto get your master password that holds the key to everything. Even if you don't store your passwords anywhere on your computer, a keylogger will certainly catch them when you type them in manually to each site you visit.Simply refraining from storing so much data in one insecure location may help prevent the scale of damage inflicted by an attacker, but there's no way to really keep your passwords safe unless you aim toprevent a hacker from even installing a backdooron your computer.Don't Miss:How to Reveal Saved Browser Passwords with JavaScript InjectionsFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Justin Meyers/Null Byte; Screenshots by tokyoneon/Null ByteRelatedHow To:Hack Your Roommate! How to Find Stored Site Passwords in Chrome and FirefoxHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)How To:This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent ItHow To:Manage Stored Passwords So You Don't Get HackedHacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyHacking Windows 10:How to Find Sensitive & 'Deleted' Files RemotelyHow To:Install the Region-Locked Firefox Browser on Your iPhoneHow To:Have Your Friends Ever Used Pandora on Your Computer? Well, You Can Steal Their PasswordsHow To:Apps & Extensions You Should Be Using Right Now in ChromeHow To:Get Split-Screen Browser Windows in Chrome, Safari, Firefox, and Internet ExplorerHow To:Disable Annoying Autoplay Media in Chrome, Firefox, Safari, and Internet ExplorerHow To:Dump a MacOS User's Chrome Passwords with EvilOSXNews:Flawed Laptop Fingerprint Readers Make Your Windows Password Vulnerable to HackersHow To:Firefox 16 Is Vulnerable to Hackers—Here's How to Downgrade to the Safer Firefox 15 VersionHow To:Access & Control Your Computer Remotely Using Your iPhoneHow To:Enable Tab Webpage Previews in Every Web BrowserHow To:Chrome's Download Bar Is Useless—This Extension Is the Fix You NeedHow To:Reveal Saved Website Passwords in Chrome and Firefox with This Simple Browser HackAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)News:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)How To:Comparing the 5 Best Internet Browsers for AndroidHow To:The 7 Most Useful Keyboard Shortcuts for Chrome, Firefox, IE, & SafariHow To:Hide All Your Browser Tabs with One Click in Chrome, Safari, Opera, and FirefoxHow To:Carve Saved Passwords Using CainHow To:Install "Incompatible" Firefox Add-Ons After Upgrading to the New FirefoxPrivate Browsing:A How-To for Firefox, Chrome & Internet ExplorerNews:Remote Chrome Password StealerHow To:Prevent Social Networks from Tracking Your Internet ActivitiesHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItHow To:Search for Google+ Posts & Profiles with GoogleHow To:Encrypt Your Sensitive Files Using TrueCryptHow To:Hide the Facebook News Ticker in Firefox and Google ChromeHow To:Remove a Windows Password with a Linux Live CDNews:Google+ Pro Tips Weekly Round Up: Resources for NewbiesHow To:Bypass Windows and Linux PasswordsHow To:Defend from Keyloggers in Firefox with Keystroke EncryptionSecure Your Computer, Part 3:Encrypt Your HDD/SSD to Prevent Data Theft