{"uuid": "2482b7cb-47e4-4a1e-a967-9ea13fec63b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/pulse_secure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Quentin Kaiser \"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": true, \"default_credential\": false, \"description\": \"This module extracts and decrypts saved Pulse Secure Connect Client passwords from the\\n          Windows Registry. This module can only access credentials created by the user that the\\n          Meterpreter session is running as.\\n          Note that this module cannot link the password to a username unless the\\n          Meterpreter sessions is running as SYSTEM. This is because the username associated\\n          with a password is saved in 'C:\\\\ProgramData\\\\Pulse Secure\\\\ConnectionStore\\\\[SID].dat',\\n          which is only readable by SYSTEM.\\n          Note that for enterprise deployment, this username is almost always the domain\\n          username.\", \"disclosure_date\": null, \"fullname\": \"post/windows/gather/credentials/pulse_secure\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:52:36 +0000\", \"name\": \"Windows Pulse Secure Connect Client Saved Password Extractor\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/windows/gather/credentials/pulse_secure.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/gather/credentials/pulse_secure\", \"references\": [\"CVE-2020-8956\", \"URL-https://qkaiser.github.io/reversing/2020/10/27/pule-secure-credentials\", \"URL-https://www.gremwell.com/blog/reversing_pulse_secure_client_credentials_store\", \"URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.953957Z"}