Finding a good KeePass app for your iPhone or iPad can be challenging. Some apps are no longer maintained, others lack necessary features. This article will give you an overview of the current options.
KeePassium
KeePass helps you to manage usernames and passwords of Windows network logon, e-mail account, FTP sites, etc. All your passwords can be stored in a single database and encrypted with a master password or a key file. The databases are encrypted using AES and Twofish algorithms so that no one can crack them. KeePass provides process memory protection that encrypts master password keys and other sensitive data when stored in computer memory. That system goes a long way to preventing malicious apps from. If you need to crack the password for a KeePass database, HashCat 3.0.0 (released 6/29/16) now includes support for KeePass 1.X and 2.X databases (-m 13400). As @Fist0urs details, you can extract a HashCat-compatible hash from a KeePass database using the keepass2john tool from the John The Ripper suite, which was written by Dhiru Kholia. KeePass uses a custom password derivation process which includes multiple iterations of symmetric encryption with a random key (which then serves as salt), as explained there. The default number of iterations is 6000, so that's 12000 AES invocations for processing one password (encryption is done on a 256-bit value, AES uses 128-bit blocks, so. KeePass Password Safe is one of the best known free password managers thanks, at least in part, to the fact that there are versions available for just about every operating system, including.
KeePassium features a clean well-polished interface and makes KeePass easy to use. It is a lightweight app that respects your privacy: offline-first, no ads, no analytics.
- Main features
- AutoFill, TouchID/FaceID, kdb/kdbx3/kdbx4, attachments, TOTP, YubiKey, iOS 13 support
- Missing pieces
- TOTP is read-only
- Synchronization
- Automatic sync via system integration (Files app), using the original cloud apps. This way, KeePassium itself stays offline).
- Transparency
- Open source (GPL-3.0)
- Maintenance / updates
- actively maintained
- User support
- very responsive
- Ethics
- published a critical review of competing apps (you are reading it now)
- Price
- free (no ads, no trial period) + premium upgrade for convenience features
MiniKeePass
Note 2: on 5 April 2020, MiniKeePass returned to the App Store with an announcement that the app will be retired by the end of the year.
Started in 2011, MiniKeePass is one of the oldest KeePass app for iOS. Unfortunately, it has been abandoned by its developers.
![Safe Safe](http://resize.over-blog.com/630x400-ct.jpg?https://media.ilsoftware.it/images/500x500png/dl_817.png)
- Main features
- AutoFill, TouchID/FaceID, kdbx4, YubiKey, iOS 13 dark mode.
- Missing pieces
- No synchronization, no attachments, no kdbx4 support
- Synchronization
- none
- Transparency
- open source (GPL-3.0)
- Maintenance / updates
- none
- User support
- none
- Ethics
- all good :)
- Price
- free
KeePass Touch
KeePass Touch is a fork of MiniKeePass, but with more features and still maintained.
- Main features
- AutoFill, TouchID/FaceID, kdb/kdbx3/kdbx4, iOS 13 dark mode.
- Missing pieces
- no file attachments
- Synchronization
- in-app support of Dropbox, FTP and local Wi-Fi sync
- Transparency
- As a fork of MiniKeePass, KeePass Touch must make its source code public, but was reluctant to do so
- Maintenance / updates
- largely inactive for years, but had several major updates in 2019.
- User support
- none
- Ethics
- questionable
- Price
- free (with ads) + one-time purchase to hide ads
- Misc
- Technically, KeePass Touch is not allowed on the App Store due to the AppStore-vs-GPL conflict. One complaint from a MiniKeePass contributor, and Apple will remove KeePass Touch from the App Store.
Strongbox
Strongbox Password Safe supports KeePass format since 2018.
- Main features
- AutoFill, TouchID/FaceID, kdbx4/pwsafe formats, TOTP, iOS 13 dark mode, very customizable.
- Synchronization
- in-app integration with several clouds, and iOS Files app.
- Transparency
- open source (AGPL-3.0)
- Maintenance / updates
- actively maintained
- User support
- very responsive
- Ethics
- all good, but finds inspiration in KeePassium :)
- Price
- free (some features disabled after a trial period) + paid premium
PassDrop 2
- Main features
- opens KeePass 1.x
kdb
databases - Missing pieces
- everything else, even no support for key files
- Synchronization
- none
- Transparency
- open source (AGPL-3.0)
- Maintenance / updates
- abandoned
- User support
- none
- Price
- free
KyPass 4
KyPass is one of the oldest KeePass apps on the App Store. It has a rather unconventional design, but is packed with features.
- Main features
- AutoFill, TouchID/FaceID, kdbx4/pwsafe formats, TOTP, InputStick,
- Missing pieces
- no iOS 13 dark mode
- Synchronization
- in-app integration with several clouds, and iOS Files app.
- Transparency
- proprietary, closed source
- Maintenance / updates
- actively maintained
- User support
- hit-and-miss, response time varies
- Ethics
- “borrowed” other developer’s code, removed inconvenient questions, and systematically abandons its paying customers
- Price
- one-time purchase (of the current version only)
AuthPass
Cross-platform app that supports KeePass format. Available on iOS, Mac and Android.
Review coming soon.
- Transparency
- Open source (GPL-3.0)
- Maintenance / updates
- under development
MiKee
New app in beta stage.
Review coming soon.
- Transparency
- Open source (GPL-3.0)
- Maintenance / updates
- under development
There is a direct link to each app, feel free to try them. If you need best quality, reliability and support — get KeePassium.
Last Updated: 2020-04-07
We see a lot of KeePass usage while on engagements. In the corporate environments we operate in, it appears to be the most common password manager used by system administrators. We love to grab admins’ KeePass databases and run wild, but this is easier said than done in some situations, especially when key files (or Windows user accounts) are used in conjunction with passwords. This post will walk through a hypothetical case study in attacking a KeePass instance that reflects implementations we’ve encountered in the wild.
First Steps
First things first: you need a way to determine if KeePass is running, and ideally what the version is. The easiest way to gather this information is a simple process listing, through something like Cobalt Strike or PowerShell:
Now it helps to know where the Keepass binary is actually located. By default the binary is located in C:Program Files (x86)KeePass Password Safefor KeePass 1.X and C:Program Files (x86)KeePass Password Safe 2 for version 2.X, but there’s also a portable version that can be launched without an install. Luckily we can use WMI here, querying for win32_processes and extracting out the ExecutablePath:
Get-WmiObjectwin32_process|Where-Object{$_.Name-like‘*kee*’}|Select-Object-ExpandExecutablePath |
If KeePass isn’t running, we can use PowerShell’s Get-ChildItem cmdlet to search for the binary as well as any .kdb[x] databases:
Get-ChildItem-PathC:Users-Include@(“*kee*.exe”,“*.kdb*”)-Recurse-ErrorActionSilentlyContinue|Select-Object-ExpandFullName|fl |
Attacking the KeePass Database
We’ll sometimes grab the KeePass binary itself (to verify its version) as well as any .kdb (version 1.X) or .kdbx (version 2.X) databases. If the version is 2.28, 2.29, or 2.30 and the database is unlocked, you can use denandz‘ KeeFarce project to extract passwords from memory; however, this attack involves dropping multiple files to disk (some of which are now flagged by antivirus). You could also try rolling your own version to get by the AV present on the system or disabling AV entirely (which we don’t really recommend). I’m not aware of a memory-only option at this point.
We generally take a simpler approach- start a keylogger, kill the KeePass process, and wait for the user to input their unlock password. We may also just leave the keylogger going and wait for the user to unlock KeePass at the beginning of the day. While it’s possible for a user to set the ‘Enter master key on secure desktop’ setting which claims to prevent keylogging, according to KeePass this option “is turned off by default for compatibility reasons“. KeePass 2.X can also be configured to use the Windows user account for authentication in combination with a password and/or keyfile (more on this in the DPAPI section).
If you need to crack the password for a KeePass database, HashCat 3.0.0 (released 6/29/16) now includes support for KeePass 1.X and 2.X databases (-m 13400). As @Fist0ursdetails, you can extract a HashCat-compatible hash from a KeePass database using the keepass2john tool from the John The Ripper suite, which was written by Dhiru Kholia and released under the GPL. Here’s what the output looks like for a default KeePass 2.X database with the password of ‘password’:
This worked great, but I generally prefer a more portable solution in Python for these types of hash extractors. I coded up a quick-and-dirty Python port of Dhiru’s code on a Gist here (it still needs more testing and keyfile integration).
Here’s the output for the same default database:
KeePass.config.xml
More savvy admins will use a keyfile as well as a password to unlock their KeePass databases. Some will name this file conspicuously and store in My Documents/Desktop, but other times it’s not as obvious.
Luckily for us, KeePass nicely outlines all the possible configuration file locations for 1.X and 2.xhere. Let’s take a look at what a sample 2.X KeePass.config.xml configuration looks like (located at C:UsersuserAppDataRoamingKeePassKeePass.config.xml or in the same folder as a portable KeePass binary):
The XML config nicely tells us exactly where the keyfile is located. If the admin is using their “Windows User Account” to derive the master password (<UserAccount>true</UserAccount> under <KeySources>) see the DPAPI section below. If they are even more savvy and store the key file on a USB drive not persistently mounted to the system, check out the Nabbing Keyfiles with WMI section.
DPAPI
Setting ‘UserAccount’ set to true in a KeePass.config.xml means that the master password for the database includes the ‘Windows User Account’ option. KeePass will mix an element of the user’s current Windows user account in with any specific password and/or keyfile to create acomposite master key. If this option is set and all you grab is a keylogged password and/or keyfile, it might seem that you’re still out of luck. Or are you?
In order to use a ‘Windows User Account’ for a composite key in a reasonably secure manner, KeePass takes advantage of the Windows Data Protection Application Programming Interface(DPAPI). This interface provides a number of simple cryptographic calls (CryptProtectData()/CryptUnProtectData()) that allow for easy encryption/decryption of sensitive DPAPI data “blobs”. User information (including their password) is used to encrypt a user ‘master key’ (located at %APPDATA%MicrosoftProtect<SID>) that’s then used with optional entropy to encrypt/decrypt application-specific blobs. The code and entropy used by KeePass for these calls is outlined in the KeePass source and the KeePass specific DPAPI blob is kept at%APPDATA%KeePassProtectedUserKey.bin.
Fortunately, recovering a KeePass composite master key with a Windows account mixin is a problem several people have encountered before. The KeePass wiki even has a nice writeup on the recovery process:
- Copy the target user account DPAPI master key folder from C:Users<USER>AppDataRoamingMicrosoftProtect<SID> . The folder name will be a SID (S-1-…) pattern and contain a hidden Preferred file and master key file with a GUID naming scheme.
- Copy C:Users<USER>AppDataRoamingKeePassProtectedUserKey.bin . This is the protected KeePass DPAPI blob used to create the composite master key.
- Take note of the username and userdomain of the user who created the KeePass database as well as their plaintext password.
- Move the <SID> folder to %APPDATA%MicrosoftProtect on an attacker controlled Windows machine (this can be non-domain joined).
- Set a series of registry keys under HKCU:SOFTWAREMicrosoftWindows NTCurrentVersionDPAPIMigratedUsers , including the old user’s SID, username, and domain. The KeePass wiki has a registry template for this here.
- Run C:Windowssystem32dpapimig.exe, the “Protected Content Migration” utility, entering the old user’s password when prompted.
- Open KeePass 2.X, select the stolen database.kdbx, enter the password/keyfile, and check “Windows User Account” to open the database.
The Restore-UserDPAPI.ps1 PowerShell Gist will automate this process, given the copied SID folder with the user’s master key, original username/userdomain, and KeePass ProtectedUserKey.bin :
If you’re interested, more information on DPAPI is available in @dfirfpi‘s 2014 SANS presentationand post on the subject. Jean-Michel Picod and Elie Bursztein presented research on DPAPI and its implementation in their “Reversing DPAPI and Stealing Windows Secrets Offline” 2010 BlackHat talk. The dpapick project (recently updated) allows for decryption of encrypted DPAPI blobs using recovered master key information. Benjamin Delpy has also done a lot ofphenomenal work in this area, but we still need to take the proper deep dive into his code that it deserves. We’re hoping we can use Mimikatz to extract the DPAPI key and other necessary data from a host in one swoop, but we haven’t worked out that process yet.
[Edit 7/1/16]Tal Be’ery also alerted me to @ItaiGrady‘s great talk, “Protecting browsers’ secrets in a domain environment” (slides here and video here).
Nabbing Keyfiles with WMI
Matt Graeber gave a great presentation at BlackHat 2015 titled “Abusing Windows Management Instrumentation (WMI) to Build a Persistent, Asynchronous, and Fileless Backdoor” (slides hereand whitepaper here). He released the PoC WMI_Backdoor code on GitHub.
One of the WMI events Matt describes is the extrinsic Win32_VolumeChangeEvent which fires every time a USB drive is inserted and mounted. The ‘InfectDrive’ ActiveScriptEventConsumer in Matt’s PoC code shows how to interact with a mounted drive letter with VBScript. We can take this approach to clone off the admin’s keyfile whenever his/her USB is plugged in.
We have two options, one that persists between reboots and one that runs until the powershell.exe process exits. For the non-reboot persistent option, we can use Register-WmiEvent and Win32_VolumeChangeEvent to trigger a file copy action for the known key path:
Register-WmiEvent-Query‘SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2’-SourceIdentifier‘DriveInserted’-Action{$DriveLetter=$EventArgs.NewEvent.DriveName;if(Test-Path“$DriveLetterkey.jpg”){Copy-Item“$DriveLetterkey.jpg”“C:Temp”-Force}} |
This trigger will clone the target file into C:Temp whenever the drive is inserted. You can also register to monitor for events on remote computers (assuming you have the appropriate permissions) with -ComputerName and an optional -Credential argument.
For reboot persistence we can easily add a new action to the New-WMIBackdoorAction function in Matt’s WMI_Backdoor code:
2 4 6 8 10 12 14 16 18 20 | $VBScript=@” Set oFSO = CreateObject(“Scripting.FileSystemObject”) sFilePath = TargetEvent.DriveName & “key.jpg” If oFSO.FileExists(sFilePath) Then “@ if($ActionName){ }else{ } |
We can then register the trigger and action for the backdoor with:
Register-WMIBackdoor-Trigger$(New-WMIBackdoorTrigger-DriveInsertion)-Action$(New-WMIBackdoorAction-FileClone) |
Cleanup takes a few more commands:
2 | Get-WmiObject-Namespace“rootsubscription”-Class“__FilterToConsumerBinding”|Where-Object{$_.Filter-like“*DriveInsertionTrigger*”}|Remove-WmiObject Get-WmiObject-Namespace“rootsubscription”-Class“__EventFilter”|Where-Object{$_.Name-eq“DriveInsertionTrigger”}|Remove-WmiObject Get-WmiObject-Namespace“rootsubscription”-Class‘ActiveScriptEventConsumer’|Where-Object{$_.Name-eq“FileClone”}|Remove-WmiObject |
Big thanks to Matt for answering my questions in this area and pointing me in the right direction.
Keyfiles on Network Mounted Drives
Occasionally users will store their keyfiles on network-mounted drives. PowerView’s new Get-RegistryMountedDrive function lets you enumerate network mounted drives for all users on a local or remote machine, making it easier to figure out exactly where a keyfile is located:
Cracking Keepass Password Safe Database Download
Wrapup
Keepass Password Safe Download
Using KeePass (or another password database solution) is significantly better than storing everything in passwords.xls, but once an attacker has administrative rights on a machine it’s nearly impossible to stop them from grabbing the information they want from the target. With a few PowerShell one-liners and some WMI, we can quickly enumerate KeePass configurations and set monitors to grab necessary key files. This is just scratching the surface of what can be done with WMI- it would be easy to add functionality that enumerates/exfiltrates any interesting files present on USB drives as they’re inserted. Vim mac.