Assume I have root/administrator access to a given computer which is currently being controlled via LogMeIn from an outside location. I see a password being typed into a browser (as little black dots). Is there any way to extract the content of the password? The question is OS-neutral though I expect that some answers will be OS-dependent. I am most interested in Linux and Windows, though OSX or "other" would also be useful to know.
It is theoretically possible to intercept any event on a computer that you have full rights on. In practice, the difficulty of intercepting will depend on the way the input comes into your computer and whether the software handling that input actively seeks to prevent that interception (think about gaming anti-cheating software).
A password typed and sent via a browser can be intercepted by using a web proxy. If SSL is in use then you have to trust the fake certificates generated by the proxy. You can use Burp Free Edition and install it's certificate.
For passwords inputted into simple software, you could also find the password in memory and write a program that reads it from memory. To find the exact memory address, you first have to input a test pattern and find it in memory. An easier way is to dump all the memory, parse the strings and look for your test pattern and remember the strings in the vicinity. Then dump the memory with the real password and look between the strings you noted at the previous step. In Linux it is easier because you have
/proc/<pid>/mem for the memory content of any process and the
strings command is built-in.
I can immediately think of two ways:
- Through the use of a keylogger sampling keyboard input to e.g. a file (the LogMeIn-session will emulate a regular keyboard and to my knowledge provide input through the same channel)
- By editing the field type of the password field in the HTML-code to a regular text field (as the black dots is made by the browser based on this). This does however have the limitation that the person controlling the session can see it as well and may become aware of it.
OS specific answer here, on Windows 8 and above when using IE and on Windows 7 with IE 10 or higher, all password fields have, by default an 'eye' icon which when clicked on, reveals the typed in password.
This can be disabled on Windows 8 via group policy, and on Windows 7 by following the steps outlined here.
You could run developer tools (e.g. press F12 on Chrome) and run this code from the console:
if the site uses jQuery this will output the value of the password entered on the page.
If there is no jQuery you can use various methods to inject it.
Of course if the user is viewing their screen, they will be able to see you do it.