Pandora: A tool for testing the security of password managers

About the project

This is a red command line tool that helps collect credentials from various password managers. They are divided into three categories: Windows 10 desktop applications, browsers, and browser plugins. It may work on other OSes, such as Linux, but this is not yet tested. In this release (version 1.0), the tool supports 14 password managers with 18 different implementations (for example, the tool can output credentials from a desktop application or a browser plugin of the same product). In particular, in most cases, password managers must be running and unlocked for the tool to work.

The tool can run in full, quick, and local modes. Full mode creates a dump and checks all processes of that password manager. Quick mode checks the most common process that usually contains credentials. Local mode checks the dump file locally. Additionally, local mode has a “merge” option that can help merge multiple dump files into one before performing the analysis. Additionally, the tool can check if a password manager directory exists to help the user determine which password manager is available for use on that host. The tool will only require normal user permissions to obtain a process dump from the password manager. Only the 1Password desktop application requires elevated integrity privileges for the user to be able to take a process dump.

The goal of this tool is therefore to provide an additional attack vector in red team engagements, as many users use password managers. Three different videos were uploaded to demonstrate how the tool works.

Regarding the remediation of these issues, most vendors responded that such issues are beyond their scope, as the attacker would need local access or AV/EDR should protect the user from such attacks. While some products may provide fixes, their exploits will be released later (they are still being disclosed). Two vendors have now acknowledged the issue and provided fixes for CVE-2023-23349 (Kaspersky) and CVE-2024-9203 (Enpass).

This is not an entirely new concept. It has been well known for some time that there is no de facto way to protect desktop applications from such attacks. However, to my knowledge, this is the first time such a tool has been made available to the public. Feel free to provide any feedback and/or suggestions/improvements. The tool only handles relevant versions. Updating a password manager can potentially change the pattern that the tool uses to identify credentials. Built in “c++”

Getting started

Using

To use this tool, simply run the compiled executable on the appropriate host and enter the name of the password manager. Depending on the password manager, there are certain requirements for the tool to be able to retrieve the credentials. However, in most cases, we kept password managers that required basic interaction to save their credentials in the memory of their process. Once launched, the tool will automatically create a dump of the appropriate process based on the selected password manager, print the credentials to cmd, and save them to a file (the file location is the current .exe folder).

To understand how this tool works, three videos have been uploaded. The videos show the phase in which an attacker can retrieve credentials from a password manager. In the case of Avira and similar password managers, this can be done without any user interaction (watch the corresponding video).

The table below provides a general idea of ​​the tool’s capabilities. Note that Firefox and related Firefox password manager plugins may not work properly. They require additional research to ensure that the tool can retrieve credentials in every case. This is because Firefox changes its template with each execution.

Note: The “Users” column refers to the number of users listed in the Chrome Web Store for each browser plugin. Browser plugins were tested using Chrome v129.0.6668.89/.90. Later versions of Chrome may interfere and change the template of each browser plugin.

prerequisites

This section is dedicated to any prerequisites that the tool will need in order to be able to reset credentials from a password manager.

1Password

The 1Password process requires high integrity privileges so that the tool can dump the process and retrieve the credentials. To retrieve the credentials, the application was opened, the master password was entered, and after waiting at least 1 minute, the tool was launched to reset the credentials. The following screenshot illustrates the execution of the tool when the application is launched. The hidden data is related to the master password. Note that the output may contain extra characters at the end of the returned string; in the screenshot, only the last character is not included in the master password. It should also be noted that the tool cannot retrieve the master password if the user has inserted it into the appropriate field. For some reason, 1password does not store the master password in the process if the user has inserted it. Regarding the 1Password plugin, the master credentials are available.

Bitwarden

NordPass

Chrome, Brave and Opera

Enpass

Firefox

Firefox uses a different pattern each time it loads credentials, either from the built-in password manager or from another browser plugin. For this reason, the search is done based on regular email addresses that are also used as usernames, such as “@gmail.com”. The code will search for this string and print some matching data before and after it. It should be noted that the user can include additional strings (check the getCredsfirefox2.h file), but the output will be huge (especially if the user resets all processes). Therefore, it is suggested to use separate strings for each analysis: starting with “@gmail.com” to identify any set of credentials, and then moving on to another string, such as “@yahoo.com”, to identify any possible password in the process. Typically, to access saved credentials, the user must visit the password manager page or visit the saved web page where the password manager saved the set of credentials. In the latter case, the process will only contain the credentials of that account. For example, if a user has saved their “Facebook” credentials and visits that web page, the process will only contain the “Facebook” credentials. Finally, Firefox has no problem starting from cmd with a command like “run firefox about:logins”.

Ironvest

For Ironvest, the corresponding web application must be launched. Since this password manager does not require a master password upon opening and provides automatic login, Chrome was launched via cmd and “ironvest.com/app” was opened. After that, the tool was used to extract all the entries. The problem is illustrated in the screenshot below: the entries are saved multiple times, as they are created each time the tool finds them in the dump file. Note that if the user or attacker does not visit the Ironvest dashboard page, the entries are not loaded in the process. Another way to obtain the entry is for the user to visit the URL of the saved entry. The autofill feature will retrieve these credentials during the process, but only for that entry. It should be noted that Ironvest deletes the entries from the process after about 2-3 minutes. Additionally, the passwords appear to be contained between a specific three characters and end with a comma.

Kaspersky

In Kaspersky, the exploit only worked for the Chrome browser. When a user opened their browser and enabled the autofill option, the password manager’s Native Messaging Server process stored each entry in plain text format and did not clean up the process. So, if an attacker has access to this host and waits for at least 1 minute, they can exploit this issue and retrieve any saved entry from this process.

Keeper

For Keeper, the program was launched, the master password was entered, and the tool was activated. The tool’s response was as follows:

LastPass

LastPass automatically logs the user into the vault when the Chrome browser is opened. So, to retrieve the master password, the user has to log out and log in manually (by entering the master password) without closing the browser. In every other case, all the entries and the master username should be retrieved. The video shows how LastPass was run via cmd. The tool dropped all the entries and the master username along with some junk data that matched the given search pattern. It is recommended to check the .txt file as it makes it easier to identify the credentials as the console will contain some junk lines.

Norton

Norton uses keywords to store credentials. So, the following screenshot illustrates the credentials that the tool dropped. The important fact was that Norton Password Manager automatically stored the username and password of the Norton user account in the vault. So, since all the relevant entries are available, if the user has not deleted the entry with his Norton account username/password, the tool will also extract them. These are the credentials that were removed from the console output. Wait 30 seconds after launching the browser to retrieve the credentials using the tool. This corresponding version asks the user to enter the master password every time they open the browser.

In the new version of the tool, the master username can also be retrieved from the password manager. The master password also exists in plain text format in the process, but there is no stable way to extract it yet.

The video has been paused to reduce its size. At the beginning, Passwordboss is launched, the master password is entered, and the program is minimized. After that, the tool is executed and waits for 3-4 minutes. As you can see, the tool retrieved all the matching records. Some of them, like Amazon, were empty, but others, like Facebook, Google, and a special one called aegean, were filled with the user’s username and password. Typically, records with data contain the character “[]”.

Roboform

Roboform automatically unlocks the storage when the user opens the Chrome browser. Specifically, Roboform requires interaction with any saved record URL or for the user to click a plugin to load the records. This way, you can start the Chrome process from cmd or powershell, and then run the tool to extract the credentials. Alternatively, the master password is available by simply opening the browser. The following screenshot shows the credentials that the tool dropped after launching Chrome from cmd. The first screenshot illustrates the output of the extracted records, while the second demonstrates the extraction of the master password.

With the Roboform app, everything is easier. If the program is running, all records can be extracted. In particular, the records will be available as saved in the password manager. This means that all possible records will be returned along with those that the user has saved. Below is an example of extracted login passwords.

#pragma once
#include <iostream>
#include <fstream>
#include <vector>
#include <string>
#include <algorithm>
#include "../../core/saveFile.h"

//Repetitiveness for Roboform
// Helper function to find occurrences of a sequence in the file data
int countOccurrences(const std::vector<unsigned char>& data, const std::vector<unsigned char>& sequence) {
    int count = 0;
    auto it = data.begin();
    while (it != data.end()) {
        it = std::search(it, data.end(), sequence.begin(), sequence.end());
        if (it != data.end()) {
            ++count;
            ++it; // Move iterator to continue search after this match
        }
    }
    return count;
}

int getCredsroboformapp4(std::string filename) {
    //Due to using saveFile2 in getCredsroboformapp2.h
    std::ifstream sequencesFile("credentials2.txt");
    std::ifstream dataFile(filename, std::ios::binary);

    if (!sequencesFile.is_open()) {
        std::cerr << "Error opening the sequences file." << std::endl;
        return 1;
    }

    if (!dataFile.is_open()) {
        std::cerr << "Error opening the data file." << std::endl;
        return 1;
    }

    // Read the entire data file into memory
    std::vector<unsigned char> fileData((std::istreambuf_iterator<char>(dataFile)), std::istreambuf_iterator<char>());
    dataFile.close();

    std::string line;
    while (std::getline(sequencesFile, line)) {
        // Convert the line to a sequence of unsigned char
        std::vector<unsigned char> sequence(line.begin(), line.end());

        // Count occurrences of the sequence in the file data
        int occurrences = countOccurrences(fileData, sequence);

        // Print and save the results only if found exactly once
        if (occurrences == 1) {
            std::cout << "Sequence: " << line << " found " << occurrences << " time." << std::endl;
            saveFile(line + "\n");
        }
    }

    sequencesFile.close();

    return 0;
}

This tool is provided as is for educational purposes and/or legal evaluation.