Finding Plaintext Password Repositories [closed]

Question

I came across a file, that was used by our tech support, to store all generic usernames and passwords in them for use with new systems. (Our company has been trained on the use of other Password storage tools, so this isn't a matter of training. The problem is that these files now exist on our network from before the team was trained. Generic accounts are already planned on being phased out as well.)

I noted this to our CISO and we have been trying to come up with a good solution as to how we can identify similar files in our network. We figured that since we have access to AD, we can probably search through all user accounts to find all instances of the first file. The problem is not necessarily what we know, but what we don't know. We want to make sure we find any instances of files used as password repositories. Are there any tools, open source or proprietary, that would accomplish this goal?

Answer 1

There are two approaches I would look into in order to accomplish this. The first is "Cornell Spider", it has the capabilities of looking inside of files for patterns. It's typically used to search for data such as social security numbers, PII, CC data. It is flexible enough that if the sheet you found has any patterns, you can hone in on those patterns and created a regular expression to search for.

An alternative way, is let's suppose that the file you found contains usernames and email addresses. Say: [email protected] You can use Powershell on a Windows machine to find files that contain those strings:

Get-ChildItem  -rec | ?{ findstr.exe 
/mprc:. $_.FullName } | select-string 
"@mycompany.com"

On a Unix based machines you could do the same thing but 1) it's really ugly, noisy, and long:

find / | xargs grep -i "@mycompany.com" >> /tmp/POSSIBLE-PII.txt

It all boils down to how that file has data structured. There are also commercially available tools that will do similar searches. Had I to tackle this, I would look for a commonality of what was in the file you found (usernames, amount of characters, domains, etc) and create a regular expression to look for files with those commonalities.

The issue with commercial tools, is they will likely be pre-populated with canned searches (SSN, CC, medical codes, etc). You are needing to find specifics. You could loop what you already discovered into another search. E.g., suppose the file you had was named passwordlist.txt you could iterate through every line, and have grep or powershell look for those instances in other files.