The LaZagne Project !!!

Description

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software.

This project has been added to pupy as a post-exploitation module. Python code will be interpreted in memory without touching the disk and it works on Windows and Linux host. The last Linux release is not up to date so I recommend using pupy to use it.

Standalones

Standalones are now available here: https://github.com/AlessandroZ/LaZagne/releases/

Installation

Requirements are available here: https://github.com/AlessandroZ/LaZagne/wiki/Requirements

pip install -r requirement.txt

Usage

• Retrieve version

laZagne.exe --version

• Launch all modules

laZagne.exe all

• Launch only a specific module

laZagne.exe browsers

• Launch only a specific software script

laZagne.exe browsers -f (for Firefox)

• Write all passwords found into a file (-oN for Normal txt, -oJ for Json, -oA for All)

laZagne.exe all -oN

• Get help

laZagne.exe -h
laZagne.exe browsers -h

• Use a file for dictionary attacks (used only when it's necessary: Mozilla Master Password, system hashes, etc.). The file has to be a wordlist in cleartext (no rainbow), it has not been optimized to be fast but could be useful for basic passwords.

laZagne.exe all -path file.txt

• Change verbosity mode (2 different levels)

laZagne.exe all -vv

• Quiet mode (nothing will be printed on the standard output)

laZagne.exe all -quiet -oA

• Retrieve passwords on another drive (default: C)

laZagne.exe all -drive D

Note: For wifi passwords \ Windows Secrets, launch it with administrator privileges (UAC Authentication / sudo)

Mac Os

Note: In Mac OS System, without the user password it is very difficult to retrieve passwords stored on the computer. So, I recommend using one of these options

• If you know the user password, add it in the command line

laZagne all --password SuperSecurePassword

• You could use the interactive mode that will prompt a dialog box to the user until the password will be correct

laZagne all -i

Supported software

(*) used by many tools to store passwords: Chrome, Owncloud, Evolution, KMail, etc.

For developers

Please refer to the wiki before opening an issue to understand how to compile the project or to develop a new module. https://github.com/AlessandroZ/LaZagne/wiki

Donation

If you want to support my work doing a donation, I will appreciate a lot:

• Via BTC: 16zJ9wTXU4f1qfMLiWvdY3woUHtEBxyriu

• Via pledgie:

Special thanks

• Harmjoy for KeeThief
• n1nj4sec for his mimipy module
• Benjamin DELPY for mimikatz, which helps me to understand some Windows API.
• Moyix for Creddump
• N0fat for Chainbreaker
• All contributors who help me on this project

---

Alessandro ZANNI
[email protected]