从 Chrome和 Edge 进程内存转储 cookie

渗透技巧 2个月前 admin

22 0 0

CookieKatz 是一个允许操作员直接从进程内存转储 Chrome、Edge 或 Msedgewebview2 的 cookie 的项目。基于 Chromium 的浏览器在启动时会从磁盘上的 cookie 数据库加载所有 cookie。

这种方法的好处是：

支持从 Chrome 的 Incogntio 和 Edge 的 In-Private 进程中转储 cookie
运行提升权限时访问其他用户浏览器的 cookie
从 webview 进程转储 cookies
无需接触磁盘上的数据库文件
无需 DPAPI 密钥即可解密 Cookie
从小型转储文件离线解析 cookie

从 Chrome和 Edge 进程内存转储 cookie

Examples:.CookieKatz.exe    By default targets first available Chrome process.CookieKatz.exe /edge    Targets first available Edge process.CookieKatz.exe /pid:<pid>    Attempts to target given pid, expecting it to be Chrome.CookieKatz.exe /webview /pid:<pid>    Targets the given msedgewebview2 process.CookieKatz.exe /list /webview    Lists available webview processes
Flags:    /edge       Target current user Edge process    /webview    Target current user Msedgewebview2 process    /pid        Attempt to dump given pid, for example, someone else's if running elevated    /list       List targettable processes, use with /edge or /webview to target other browsers    /help       This what you just did! -h works as well

CookieKatz-BOF

beacon> help cookie-katzDump cookies from Chrome or EdgeUse: cookie-katz [chrome|edge|webview] [pid]
beacon> help cookie-katz-findFind processes for Cookie-Katz
Use: cookie-katz-find [chrome|edge|webview]

CookieKatzMinidump

Usage:    CookieKatzMinidump.exe <Path_to_minidump_file>
Example:    .CookieKatzMinidump.exe .msedge.DMP
To target correct process for creating the minidump, you can use the following PowerShell command:    Get-WmiObject Win32_Process | where {$_.CommandLine -match 'network.mojom.NetworkService'} | select -Property Name,ProcessId