Add KeePass trigger abuse module

[d3lb3]

A module to automatically abuse KeePass trigger system in order to perform a cleartext export of the database.
The underlying theory is described at the end of this harmj0y's blogpost (Exfiltration Without Malware – KeePass’ Trigger System).

Basic module usage :

Various options are also available, for which I can write a tutorial blog post / entry on CME wiki if needed :

[mpgn]

[d3lb3]

Thanks for the review !

I would argue that if you don't force KeePass restart (and just wait for a "natural" reload, for example when the targeted user launches KeePass the next morning) the module is pretty opsec safe as it only uploads/downloads files and execute benign PowerShell commands (list process, look for files) compared to "louder" actions like dumping a process or injecting DLL "à la KeeThief".

Switching between ENCODE and PS1 for PSH_EXEC_METHOD I managed to execute the module against with no detection by popular EDRs such as Trend and Kaspersky. I jut can't figure out why Trend flags a simple powerhsell -e dwBoAG8AYQBtAGkA by default, as it is just a whoami... 😑​