vbakeepass

Hand Masterpassword to keepassxc-cli (or retrieve entry from keepassxc by vba)

I tried a lot with the keepassxc-cli manpage but was not able to solve my seemingly simple task. I couldn't find real examples as well.

I want to invoke keepass-cli from a vba-script (I have reasons ;-) ) and retrieve a username/password (can be in two steps) to use in a script. I can copy the password on the shell when typing:

$ keepassxc-cli clip "path\to\db" "db entry name"

Then I am prompted to type in my master password. However I would like to keep the user from the cli and rather have an input in my original script so the user can type the master password there and the password is handed over seamlessly.

In short I am looking to a way to enter something along the lines

$ keepassxc-cli clip "path\to\db" "db entry name" -master "my secret master password"

NB: keepassxc has the option --pw-stdin which keepassxc-cli seems to be missing. (Then I could use this answer) Security level overall is quite low, however I don't want to put a database pw (for read access) verbatim into the script (as it is done by my predecessor), and in a company environment I cannot install plugins for keepassxc or similar.

Any pointers to some examples of keepass-cli examples are also very much appreciated.

Solution

  • Your post is tagged with VBA, and your answer looks like a linux shell?

    I couldn't get that to work using CMD, invalid credentials errors etc. (although I didn't try all that hard)

    Powershell handles it just fine though.

    Assumed you wanted VBA, the paths to the cli and database would need to be changed.

    Sub ClipPassword(Name As String, Master As String)
CreateObject("WScript.Shell").Run "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Noninteractive -NoProfile -Command " & Chr(34) & Chr(39) & Master & Chr(39) & " | &" & Chr(39) & "C:\Path\To\KeePassXC-2.7.4-Win64\keepassxc-cli.exe" & Chr(39) & " clip " & Chr(39) & "C:\Path\To\Passwords.kdbx" & Chr(39) & " " & Name & Chr(34)
End Sub

    The command run in powershell is essentially the same as your answer

    "masterpassword" | &keepasxc-cli clip "database" account