KeePass Cracking

KeePass cracking turns a stolen password manager into the keys to everything else: you locate the .kdbx database, extract its hash with keepass2john, break the master password offline and open the vault, which usually holds SSH, domain, database and panel credentials.

Why it works. KeePass encrypts the database with a key derived from the master password (and, if present, a .key file). That derivation is a perfect target for an offline dictionary attack: nobody locks your account or watches you try millions of candidates. And .kdbx files end up in reachable places (user profiles, shares, backups) because the user trusts that "it's encrypted".

The abuse. You pull the hash out of the database and attack it with john or hashcat; the master password opens the vault.

keepass2john <file>.kdbx > kp.hash          # with a key file: keepass2john -k <file>.key
john --wordlist=<rockyou.txt> kp.hash
hashcat -m 13400 kp.hash <rockyou.txt>          # mode 13400 = KeePass
# open the database with the master password and dump entries
kpcli --kdb <file>.kdbx

Dictionary-free variant: CVE-2023-32784. KeePass 2.x before 2.54 leaves almost the entire master password in memory in cleartext (every character except the first), recoverable from a process dump, a .dmp, a crash dump or hiberfil.sys. No cracking needed:

# dump the KeePass process (procdump/Task Manager) and extract the master from the dump
python3 keepass-password-dumper.py KeePass.DMP
# -> ●assword: recovers the master minus the first character (few variants to try)

Requirements. Read access to the .kdbx file (and the .key if the database uses one). If the master is strong and there is a separate key file, cracking may be infeasible; in that case the memory route (CVE-2023-32784) bypasses it when the version is vulnerable and the process can be dumped.

How to detect it. Stealing a .kdbx is hard to see once exfiltrated (the cracking happens off-box). The defensive signal is earlier: anomalous access to .kdbx files, copies to temp paths, or their egress over the network. Monitor access to vaults and alert on reads by processes other than KeePass itself.

Defence. A long, random master password plus a key file stored apart from the .kdbx, don't leave the database on shares, and encrypt backups. It chains with credential hunting and credential reuse; it is a cousin of .pfx cracking and hash cracking.