Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Notes on Browser-Based Credential Stealing
This page is for recording notes associated with harvesting creds from different browsers. The contents of this page are to be migrated into the larger wiki once a suitable place in the wiki hierarchy has been identified and "enough" information is present on this page.
Note that these notes which are noted on this page of notes should be noted as being the result of a work in progress. Thus, these notes noted here are subject to revision, and it should be duly noted that these notes noted here may be incomplete or slightly inaccurate in spots. You are encouraged to verify any noted items prior to trusting them.
Browsers
Internet Explorer
Current research indicates that IEInternet Explorer has a few different categories for stored information (creds & data). These are AutoComplete (forms), Password Protected site (a page that utilizes say, Basic Auth or Digest Auth for access), and FTPFile Transfer Protocol creds (5),(6).
Storage locations are said to vary based on the version of IE, the underlying OSOperating System (e.g., Windows 8), and the category of stored information.
Autocomplete can be disabled within the html of a specific page by a page author, via use of the "autocomplete" property(7),(8) on certain elements (e.g., an "input" element).
IE4-6
Autocomplete Form Data and Passwords
TBPosted. Until more info is posted in this section, please look at some of the references such as (5), (6), and (10).
IE7-9
Autocomplete Form Data and Passwords
Experimental evidence (checked with IE8, on Win7 x86) corroborates with written sources(3), (4), (5), (6), (10), (11) that IEInternet Explorer will store AutoComplete form data in a couple different registry keys, depending upon the nature of the form data.
The first key:
HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage1is used to store non-password form data (e.g., an "input" html element whose 'type' attribute is NOT 'password'). For example:
<!DOCTYPE HTMLHypertext Markup Language PUBLIC "-//W3C//DTD HTMLHypertext Markup Language 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>
A Form to test cred gathering
</title>
</head>
<body>
<form method=GET action="">
<p>Username:<input type=text name=username size=32 maxlength=32>
<p>Password:<input type=text name=password size=32 maxlength=32>
<p><input type=reset value="RESET">
<p><input type=submit name="submitit" value="SUBMIT">
</form>
</body>
</html>Note the 'type=text' attribute on the input element named 'password'. One can use common utilities such as procmon or regshot to see IEInternet Explorer interact with the 'Storage1' registry key when processing the above form.
The second key:
HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2is used when there is 'password' data to store AND Internet Explorer recognizes the form as a "login"/password type of form(1). IEInternet Explorer can apparently be rather picky about remembering form and especially credential data(1). For example:
<!DOCTYPE HTMLHypertext Markup Language PUBLIC "-//W3C//DTD HTMLHypertext Markup Language 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>
A Form to test cred gathering
</title>
</head>
<body>
<form method=GET action="">
<p>Username:<input type=text name=username size=32 maxlength=32>
<p>Password:<input type=password name=password size=32 maxlength=32>
<p><input type=reset value="RESET">
<p><input type=submit name="submitit" value="SUBMIT">
</form>
</body>
</html>Note the 'type=password' attribute & value for the input element named 'password'. One can use common utilities such as procmon or regshot to see IEInternet Explorer interact with the 'Storage2' registry key.
Within the aforementioned registry keys, Internet Explorer creates REG_BINARY entries which correspond to visited URLs. The Value Name of a REG_BINARY value is the hex representation of a combination of the hex representation of the 20 byte SHA1 has of the URL, along with a "checksum" byte. The value name is crafted via:
- For a given URL, which is in lowercase (unknown what that would actually mean for a non-western alphabet) and encoded as a NULL terminated, UTF-16 LE string, calculate the SHA-1 hash of the URL. This will yield a twenty byte value.
- For each byte of the twenty bytes of the URL's hash, add them together modulo 256 (i.e., store a running tally of the bytes of the hash in an unsigned char)
- Form a string which consists of the concatenation of the hex representation of the hash and the hex representation of the checksum byte's value.
For an example, consult the following Python (2.7.x) session/code:
>>> import hashlib
>>> url = "http://192.168.146.128:8080/creds_form_savepass.html" + "\x00"
>>> url_utf_16_le = url.encode("utf-16-le")
>>> sha1obj = hashlib.sha1(url_utf_16_le)
>>> urldigest = sha1obj.digest()
>>> checksum = 0
>>> len(urldigest)
20
>>> for abyte in urldigest:
... checksum = (checksum + (ord(abyte))) & 0xFF
...
>>> hash = sha1obj.hexdigest().upper()
>>> cksum = "%02X" % checksum
>>> reg_value_name = "%s%s" % (hash, cksum)
>>> print reg_value_name
263E55A1AC93C5F70F2F3CAB9F1DCEE4A899B2E9C4the resultant reg_value_name is the value name which will be found in the registry under one of the aforementioned registry keys.
IE10+
Autocomplete Form Data and Passwords
TBPosted. Until more info is posted here, please feel free to browse some of the listed references such as (6) and (10)
Chrome
Firefox
References
(1) Law, E., Why Won't IEInternet Explorer Remember My Login Info?, MSDNMicrosoft Developer Network Blogs, IEInternals, 10-Sep-2009, Last Accessed 3-Aug-2015
(2) Law, E., Forcing Internet Explorer To Forget to Not Remember, MSDNMicrosoft Developer Network Blogs, IEInternals, 08-Apr-2010, Last Accessed 3-Aug-2015
(3) Diaz, William, Exploring IE's Form Data, Windows Explored, 22-Dec-2011, Last Accessed 3-Aug-2015
(4) "Where does Internet Explorer Stores its form data history that it uses for auto completion?", Stack Overflow, 1276700, 14-Aug-2009, Last Accessed 3-Aug-2015
(5) IEInternet Explorer PassView Utility, nirsoft.net, Last Accessed 3-Aug-2015
(6) Protected Storage PassView, nirsoft.net, Last Accessed 3-Aug-2015
(7) Using AutoComplete in HTMLHypertext Markup Language Forms, msdn.microsoft.com/en-us/library/ms533032(v=vs.85).aspx, Last Accessed 3-Aug-2015
(8) autocomplete attribute|autocomplete property, msdn.microsoft.com/en-us/library/ms533486(v=vs.85).aspx, Last Accessed 3-Aug-2015
(9) "DPAPI Secrets, Security analysis and data recovery in DPAPI", passcape.com, Last Accessed 3-Aug-2015
(10) "Exposing the Password Secrets of Internet Explorer", securityxploaded.com/iepasswordsecrets.php ,Last Accessed 4-Aug-2015
(11) "How Browsers Store Your Passwords (and Why You Shouldn't Let Them), RaiderSec Blog, raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html ,Last Accessed 4-Aug-2015
(12) SapporoWorks, "The certification password of Internet Explorer 7 and operation of auto complete", 25 Jan 2007, securityfocus.com/archive/1/458115/30/0/threaded ,Last Accessed 5-Aug-2015