In our next demo,
we're going to look at getting credentials from files using LaZagne.
That's entry T1552.001 from the MITRE ATT&CK framework.
We're going to look at some of the sysadmin programs that LaZagne can
target where files are often used for password storage.
In some cases,
we'll see the files that LaZagne is looking in to find the passwords.
Starting with our LaZagne executable,
we're going to look at the modules available under sysadmin.
From the list,
we can see a good selection of tools that people
commonly use for things like FTP, SSH, RDP,
and VNC.
That's potentially going to get us credentials for access to other machines
that this user performs some level of administration on.
Instead of choosing a specific tool,
we're just going to target all of the tools under sysadmin and see
which of them have credentials on this machine.
And we can see we've got a couple of hits.
The first is from Filezilla,
which is an FTP client that's capable of storing passwords.
The second is a KeePass database.
KeePass is a tool designed specifically to store passwords.
So while LaZagne hasn't given us a password,
it has pointed us to a file which could contain a database of passwords.
If there is some password reuse going on,
then maybe one of the other passwords we find could grant access to that.
Now running that again with Python just to confirm, we've
got the same results, and there we go.
Something that may be of use is the option to get verbose output with ‑v.
It's the same in Python and executable options, so we'll just run it
from Python. We're using two vs for extra verbosity. Scrolling up, we
can see we've got a few errors under VNC and a list of file and
registry locations being searched.
This is perhaps useful. But if you really want detail,
you can always look at the code.