KeePwn
A python script to help red teamers discover KeePass instances and extract secrets.
KeePass Discovery:
- Accept multiple target sources (IP, range, hostname, file)
- Automatically look for KeePass global installation files via SMB C$ share.
- Automatically check for KeePass binary's metadata (version, last access time).
KeePass Trigger Abuse:
- Add and remove triggers from KeePass configuration file via SMB C$ share.
- Automatically poll for cleartext exports on the remote host.
KeePass Plugin Abuse:
- Automatically upload a plugin (DLL or PFX format) to extract passwords, see KeeFarce Reborn.
- Automatically poll for cleartext exports on the remote host.
Authentication:
- Support LM/NT hash authentication.