-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Try to extract passwords from all user contexts (Linux) #125
Conversation
Awesome work !!! Thanks a lot. |
I have added a missing tab to retrieve all profiles on firefox (here). And I have an error running the wallet module with sudo:
The problem is that DBUS_SESSION_BUS_ADDRESS is in environ but not in os.environ. So if replace every os.environ by environ or the contrary, it works without errors but not passwords were found. I don't know if you managed to retrieved passwords from wallets when sudo. Thanks again for your work. |
To be able to access dbus seteuid to the user should be done. I'll check what is wrong with sudo |
I have no issues with sudo. Check that you have secretstorage installed for root user |
I don't understand how it could work with sudo for wallets (at least on gnome and kde) because I had added a verification line to not run the tool with sudo (gnome and kde). For libsecrets, I have this error which is produced here (the error is catched by the except line so it's not a blocking point but no passwords are retrieved from this module).
|
Well, I don't know how gnome/kde works (don't use DEs for years), and didn't add enumeration for these modules. So enumeration (should) work just for libsecrets.
You can try to check with strace where you connect when extraction is successful and compare to addresses which extracted by homes.session. Messages about 'object does not exist' comes from valid dbus session daemons which are not connected to desktop session with secrets provider. |
Ok I will investigate it on these possible errors when I will have some time. Here is my distribution:
|
I can reproduce but it's a bit non-trivial case. Will look into it deeper once have some time |
Well, situation is a bit sad. The situation is sad because dbus is shit and was written by shit masters. Looks like user session initialized only once after library load. |
Please try my latest head - alxchk@d499805 |
Ahaha you make me laugh, I could feel your disappointment :)
With your new patch, it works great. It takes a little longer to execute but it works so it's great. Thanks a lot for your contribution. |
Just to let you now, it takes a bit longer because it receives a timeout response (but then I got all credentials).
|
I started PR with omitting DBUS connections where secrets are not activated yet. This will be faster, but in theory there is probability that something may be missing (I think it's very unlikely, but maybe that can be checked) |
Try to extract passwords from all user contexts (Linux)
Try to extract passwords from all user contexts (Linux) Former-commit-id: a941deaacd296483f6e491030a256304d822bd94 [formerly fe64595] Former-commit-id: 0daa1776712369f5fddfb706235c18b04b99b455
#121
I don't have all those software to check that something wasn't broken, but looks like most works ok. To feel the difference try to run as root on PC with running user sessions