Skip to content

Fix powershell foxdump#812

Open
asantoma wants to merge 5 commits intoBC-SECURITY:mainfrom
asantoma:fix-powershell-foxdump
Open

Fix powershell foxdump#812
asantoma wants to merge 5 commits intoBC-SECURITY:mainfrom
asantoma:fix-powershell-foxdump

Conversation

@asantoma
Copy link

@asantoma asantoma commented Feb 25, 2026

Describe your changes

I've tried the powershell foxdump module on a win10 x64 target with a recent firefox version and noticed it's not working so I've addressed the following issues:

  • The script tried to import NSSBase64_DecodeBuffer from nss3.dll, which doesn't seem to export it anymore. I've replaced the usage of NSSBase64_DecodeBuffer with the powershell built-in FromBase64String;
  • The script looked for the first Firefox profile whose name matched *.default but that profile may not exist or may not contain credentials. I've updated it to dynamically try to determine all profiles present in Mozilla\Firefox\Profiles\ and dump credentials from them;
  • The script wouldn't start on an x64 bit machine because of a 64-bit check killswitch. I've removed it and instead made it search for a 64-bit firefox installation if it detects it's running as a 64-bit powershell process.
  • The script would load two unused dlls: msvcp120.dll and msvcr120.dll. I've removed the loading of those DLLs since they are not needed and they are outdated (only msvcp140.dll exists on current firefox)

I have manually tested the script and its execution as an Empire module and I have found it to work.

Issue ticket number and link (if there is one)

Checklist before requesting a review

  • I have performed a self-review of my code
  • If it is a core feature, I have added thorough tests.
  • I have added an entry to CHANGELOG.md
  • I have updated the documentation in docs/ (if applicable)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants