CVE-2023-32784 PoC — KeePass 安全漏洞

Source

https://github.com/hau-zy/KeePass-dump-py

Associated Vulnerability

Title:KeePass 安全漏洞 (CVE-2023-32784)
Description:In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

Description

Re-write of original KeePass 2.X Master Password Dumper (CVE-2023-32784) POC in python.

Readme

# KeePass-dump-py

My attempt to re-write the original KeePass 2.X Master Password Dumper (CVE-2023-32784) POC in python. 

Please head over to [Original POC](https://github.com/vdohney/keepass-password-dumper) for more details about the vulnerability and exploitation process.

What this script does:
1. Checks if KeePass process is running, otherwise it spawns the KeePass
2. Dumps KeePass process using WerFault (code snippet adapted from LSASSY)
3. Search process dump for password

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!