rapid7/metasploit-framework — pull request #4004 by martinvigo (2014-10-13 06:01:36+00:00)
Title: Lastpass credentials

This post exploitation module will extract and decrypt master passwords stored in the victim's machine.

LastPass has an option to "remember the master password". This is to avoid having to input the password overtime the user logs in. What happens in the background is that LastPass will encrypt the password and store it in a sqlite3 database or preference file (depends on the browser).

This module will search all browsers (Firefox, Chrome, Opera and Safari) for the file and attempt to extract that information. once that is done, it will decrypt the data and show the username and master password in clear text to the attacker.

The module only takes one parameter, the session id. And it works for both, meterpreter and shell sessions.

More details can be found in a post I published about the research I've done on this topic here: http://www.martinvigo.com/a-look-into-lastpass/

The setup for a testing environment is easy. All that is needed are browsers with the plugin installed. Please note that LastPass allows for some browsers/OS a "binary option". This module only works on the "pure" browser plugin. The reason is that the binary option takes advantage of the OS encryption mechanism (keychain in MAC for example) and that cannot be decrypted. Also, the option to "Remember my password" needs to be activated in order for the password to be stored locally