Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory

DumpBrowserSecrets is a Windows post‑exploitation credential harvesting tool that targets Chromium-based (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox browsers to extract saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history and bookmarks. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium instance and injecting a DLL via Early Bird APC to call the IElevator COM interface, retrieves DPAPI or NSS keys where applicable, and outputs structured JSON, while employing evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, and a custom SQLite parser). The report assesses attack scenarios, detection opportunities (injection into browser processes, IElevator calls, unauthorized reads of browser SQLite files), and mitigation guidance including using external credential managers and EDR rules focused on browser process behaviour.