DO NOT DEAL WITH THIS MEMBER
Hello, I need help please, I have access to a remote machine, I recovered the folder where firefox and chrome store their cookies and password, by default the firefox data is not not encrypted, so I easily recovered them by the DBrowser tool, but unfortunately I cannot recover the data on chrome because they are protected by the DPAPI (it is possible to crack the DPAPI by launching the tool Mimikatz on the machine but it will attract the attention of sysadmin because mimikatz is detectable by windows defender) so I need a solution to crack in offline mode (the recovered folder is in C: \ Users \ [Username] \ AppData \ Local \ Google \ Chrome \ User Data \ Default \])
Note: In the case of a linux machine, I also got the chrome folder under ~ / .config / google-chrome / Default but I can't crack the data either [whether it's under windows ( DPAPI) or under linux), chrome pissed me off ...
DO NOT DEAL WITH THIS MEMBER
which rat r u using?? I might be able to help u out with this.
Instead of retrieving the folder and file from the remote machine. Try using and keylogger or stealer that can recover Password and cookies from Popular Browsers.
(Aug 20, 2020 07:04 AM)Fire_Star Wrote: which rat r u using?? I might be able to help u out with this.
Instead of retrieving the folder and file from the remote machine. Try using and keylogger or stealer that can recover Password and cookies from Popular Browsers.
you know any stealer which steals cookies?
DO NOT DEAL WITH THIS MEMBER
(Aug 20, 2020 09:06 AM)Elijah Wrote: you know any stealer which steals cookies?
Not aware of any stealer that's being sold on HF. There are some on Github though.
https://github.com/LimerBoy/Adamantium-Thief
https://github.com/0xPh0enix/Adamantium-...cookie_fix
Hope This Helps.
(Aug 20, 2020 09:18 AM)Fire_Star Wrote: Not aware of any stealer that's being sold on HF. There are some on Github though.
https://github.com/LimerBoy/Adamantium-Thief
https://github.com/0xPh0enix/Adamantium-...cookie_fix
Hope This Helps.
am not a coder, dont know how to compile it,
By any chance can you compile silent executable of it?
DO NOT DEAL WITH THIS MEMBER
(Aug 20, 2020 11:07 AM)Elijah Wrote: am not a coder, dont know how to compile it,
By any chance can you compile silent executable of it?
Am not a coder either my Friend. Even I don't know how to compile it or make a silent FUD executable out of it.
(Aug 20, 2020 11:17 AM)Fire_Star Wrote: Am not a coder either my Friend. Even I don't know how to compile it or make a silent FUD executable out of it.
ahh thanks mate.
DO NOT DEAL WITH THIS MEMBER
(Aug 20, 2020 11:26 AM)Elijah Wrote: ahh thanks mate.
You are welcome Friend.
DO NOT DEAL WITH THIS MEMBER
I'm not using any RAT , I don't have access anymore to the server , I'm just trying to retrieve passwords in an OFFLINE mode from the folders , keyloggers and passwords grabber won't help me..
(Aug 20, 2020 01:54 PM)SIM-4329724 Wrote: I'm not using any RAT , I don't have access anymore to the server , I'm just trying to retrieve passwords in an OFFLINE mode from the folders , keyloggers and passwords grabber won't help me..
Pretty Sure you are scewed, chrome stores cryptographic keys inside of "Local State" and you need to do certain things to decrypt them, in addition to this, google chrome has cookies saved for runtime or something, pretty sure the only way to get cookies from google chrome is Javascript injection, and form grabbing.
DO NOT DEAL WITH THIS MEMBER
{ "Chrome stores cryptographic keys in" Local State " } is the answer I was looking for.
Do u know how can I grab the master key ?
|
