4

Assume I have root/administrator access to a given computer which is currently being controlled via LogMeIn from an outside location. I see a password being typed into a browser (as little black dots). Is there any way to extract the content of the password? The question is OS-neutral though I expect that some answers will be OS-dependent. I am most interested in Linux and Windows, though OSX or "other" would also be useful to know.

Improve this question
1
  • 2
    Others have already provided good answers. I would like to add that you can use social engineering which is the best and most effective way in my opinion. You have access to the machine and some one will have access from outside to it. It means you have lot of time to create a honeypot type environment on your machine. For eg: Phishing: create a fake login page and lure the user to login through it. Or Make the autosave password without prompt. Other possibility could be to use wireshark and sniff the plain text passwords. This won't work if https is in use.
    – ρss
    Jun 5, 2015 at 8:20

4 Answers 4

Reset to default
3

It is theoretically possible to intercept any event on a computer that you have full rights on. In practice, the difficulty of intercepting will depend on the way the input comes into your computer and whether the software handling that input actively seeks to prevent that interception (think about gaming anti-cheating software).

A password typed and sent via a browser can be intercepted by using a web proxy. If SSL is in use then you have to trust the fake certificates generated by the proxy. You can use Burp Free Edition and install it's certificate.

For passwords inputted into simple software, you could also find the password in memory and write a program that reads it from memory. To find the exact memory address, you first have to input a test pattern and find it in memory. An easier way is to dump all the memory, parse the strings and look for your test pattern and remember the strings in the vicinity. Then dump the memory with the real password and look between the strings you noted at the previous step. In Linux it is easier because you have /proc/<pid>/mem for the memory content of any process and the strings command is built-in.

Improve this answer
1
  • The memory dump method works but requires some hardwork. I used it to get the truecrypt volume password. But this option only worked if you allow truecrypt to keep the password in the memory. This option is on the window when you enter a truecrypt password. So, if the software doesn't keeps the password in the memory then this method won't work.
    – ρss
    Jun 5, 2015 at 8:09
2

I can immediately think of two ways:

  • Through the use of a keylogger sampling keyboard input to e.g. a file (the LogMeIn-session will emulate a regular keyboard and to my knowledge provide input through the same channel)
  • By editing the field type of the password field in the HTML-code to a regular text field (as the black dots is made by the browser based on this). This does however have the limitation that the person controlling the session can see it as well and may become aware of it.
Improve this answer
2

OS specific answer here, on Windows 8 and above when using IE and on Windows 7 with IE 10 or higher, all password fields have, by default an 'eye' icon which when clicked on, reveals the typed in password.

This can be disabled on Windows 8 via group policy, and on Windows 7 by following the steps outlined here.

Improve this answer
0

You could run developer tools (e.g. press F12 on Chrome) and run this code from the console:

$('input:password').val()

if the site uses jQuery this will output the value of the password entered on the page.

If there is no jQuery you can use various methods to inject it.

Of course if the user is viewing their screen, they will be able to see you do it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .