module

Windows Gather Skype Saved Password Hash Extraction

Try Surface Command
Back to search
Disclosed
N/A
Created
May 30, 2018

Description

This module finds saved login credentials
for the Windows Skype client. The hash is in MD5 format
that uses the username, a static string "\nskyper\n" and the
password. The resulting MD5 is stored in the Config.xml file
for the user after being XOR'd against a key generated by applying
2 SHA1 hashes of "salt" data which is stored in ProtectedStorage
using the Windows API CryptProtectData against the MD5

Authors

mubix mubix@hak5.org
hdm x@hdm.io

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use post/windows/gather/credentials/skype
    msf post(skype) > show actions
        ...actions...
    msf post(skype) > set ACTION < action-name >
    msf post(skype) > show options
        ...show and set options...
    msf post(skype) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today