Treasure Hunting | Taking Riches From Sticky Notes by TreyCraf7 - HTB Village at H@ctivityCon 2021
Source: YouTube · Hack The Box · published Sep 18, 2021 · 19:45
Microsoft Sticky Notes stores all user-entered data persistently in a SQLite database, creating a security risk where attackers can extract sensitive information like credentials even from closed notes 0:51-1:30.
Key Takeaways:
• Sticky Notes stores everything in a SQLite database that remains even when notes are closed 5:14-6:04
• The database is located at %localappdata%\packages\microsoft.stickynotes\localstate\plum.sqlite for modern Windows 7:36-7:52
• Attackers can extract notes using PowerShell with the PSSQLite module or by copying the database file 9:00-9:12
• The presenter created a Python tool called "no dumped up" to easily extract note text from the database 13:19-13:32
• Mitigations include disabling sync features, using password managers, and avoiding storing sensitive data 16:34-18:12
Users should avoid storing credentials or sensitive information in Sticky Notes and consider using password managers instead 18:12-18:14.
Sources:
- 0:51-1:30 The hook explaining how Sticky Notes stores everything
- 5:14-6:04 The SQLite database backend problem
- 7:36-7:52 Database file location
- 9:00-9:12 PowerShell extraction method
- 13:19-13:32 Python tool for extraction
- 16:34-18:12 Mitigation strategies
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
all right good afternoon everybody my name is trey or tradecraft doesn't handle you'll notice it through academy and other places i'm here today to talk to you a little bit about one of my favorite things to do when looking for some juicy information or creds or something like that once we've landed on a host this is my talk treasure hunting taking riches from your sticky notes so who am i my name is trey again i'm tradecraft uh one of the content devs for hack the box academy i've got certs and stuff like that if those things are important to you um you can check them out on linkedin and then there's my twitter handles if you are curious or care let's get on to why you're actually here and while you're listening to me right now so the hook what if i told you that everything you've ever ty…