<https://isc.sans.edu/diary/32954> anyone tried t...
# _general
m
https://isc.sans.edu/diary/32954 anyone tried this on multi session yet to see if you can get creds for another user?
😱 3
j
F*cking hell
💯 3
j
> “Edge is the only Chromium‑based browser I’ve tested that behaves this way.” > Chrome, for example, only decrypts a password when it is needed and also uses Application-Bound Encryption feature as an additional defence against information theft, which locks the keys to an authenticated Chrome process, running as SYSTEM. Therefore, passwords only briefly appear in plain text during autofill, or when users view them.
Copy code
strings -n 5 -u .\msedge.dmp |
Select-String -Pattern "knownpw" -Context 10,10
sheeeeesh, i get the "requires admin to do a dmp"...but it's not like there's a shortage of priv escalation exploits out there
m
Did you see if you can do a dump of edge running in another user's session?
j
let me save some passwords in edge @ work.. i don't have saved pws in my edge profile at work (i needed somethign to hit my select-string on).
I'm not getting hits when I did a dump from my session of edge running as another user
it could be PEBKAC, but
Copy code
PS C:\Users\xJBucud\appdata\Local\Temp> Get-CimInstance Win32_Process -Filter "Name = 'msedge.exe'" |
>> ForEach-Object {
>>     $owner = $_ | Invoke-CimMethod -MethodName GetOwner
>>     [PSCustomObject]@{
>>         ProcessId   = $_.ProcessId
>>         Name        = $_.Name
>>         User        = "$($owner.Domain)\$($owner.User)"
>>     }
>> }

ProcessId Name       User
--------- ----       ----
     7376 msedge.exe LC\jbucud
    13104 msedge.exe LC\jbucud
     5604 msedge.exe \
    12256 msedge.exe LC\jbucud

PS C:\Users\xJBucud\appdata\Local\Temp> whoami
lc\xjbucud

PS C:\Users\xJBucud\appdata\Local\Temp> .\strings64.exe -n 5 -u .\msedge.dmp | Select-String -Pattern "knownpassword" -context 10,10
that's my process
m
Interesting
j
one sec... i think i know whats going on...
i didn't accept the EULA, and since sysinternals stuff doesn't actually "run anything" until you do, it was just returning a blank line. ....it hits....
j
[slash]accepteula
👍🏼 1
j
yup, thanks James, caught that after i realized that was why i was getting no hits the first time
😄 2
m
Yeah that's what I was worried about, so any admin could dump any users passwords. Pretty sure there's an expectation of privacy from users here
j
Is that right (sorry wasn't following closely), an admin could dump the passwords of other users....on the same box?
j
Yeah that's what I did above. Any saved password in Edge, is readable in plain text at all times in Edge memory dump. Task Manager -> Edge -> Created Dump -> use Strings, search for something in proximity of password (username works as well, since password hit in the context search) and you have your passwords.
String is obviously not the best tool for this, but it proves it's all in there... Edge running as my daily driver user "jbucud", dumped by my elevated account "xjbucud"
j
CISO gonna love me tomorrow. Great work!
j
Just make sure to show them
🙌 1
😀 1
j
Haha, so they want us to disable the saving of passwords (which you can do via GPO) and clear any existing saved ones.... can you remove cached passwords programmatically without clearing the whole Edge profile?
m
you need to disable edge sync and then delete their login data under the profile
otherwise it'll pull all the passwords down again
I haven't tried it though