May 13, 2012 04:32 AM (This post was last modified: May 13, 2012 04:33 AM by pr0t0typ3.)
Hey guys
Over the last view days and weeks I've been working on a formgrabber.
Current features are:
Coded in C++ without external dependencies
Full PE-Injection (No DLLs)
No byte-pattern scanning for API hooks (Formgrabber works for all versions of every browser mentioned)
Proper API hooking (the formgrabber does only hook functions directly related to the networking of the browser itself instead of hooking routines like RtlFreeHeap (like SpyEye does))
No hardcoded URLs (Unlimited URLs and form fields can be specified)
Grabs HTTP/HTTPS Requests on IE
Grabs HTTP/HTTPS Requests on FF
Grabs HTTP/HTTPS Requests on Chrome
Grabs HTTP Requests on Opera
Grabs HTTP Requests on Safari
Registry Persistence
I'm currently looking for suggestions what to add while I have a experienced web developer create the panel.
For people who don't belive me about the Chrome SSL Grabber: Spoiler (Click to View)
Thank you for the offer, but as I don't have any startup funds, I need to find an investor or something.
I'm also not sure how much to charge per copy yet. I guess around 75 - 100 $
IE and FF Formgrabber sources are public. Therefor buying these is a huge waste of money. Instead, I did create a properly working Chrome Grabber (with SSL) support which is not available in any other project (exactly like Safari).
(May 13, 2012 12:36 PM)DMC4 Wrote: Does this support web injects?
I will be interested, if it has similar characteristics to zeus.
No, it is a formgrabber and no crimeware pack. Webinjects are possible using the same technique but I did not implement it into this formgrabber.
(May 13, 2012 01:02 PM)Pinch Wrote: Looks pretty good. If price isn't too high I might actually buy this.
Thank you, I hope I will find a fair price.
(May 13, 2012 01:05 PM)Gone With The Wind Wrote: oh and Ares formgrabber was first 🤗
Congratulations, anything else you want to share with us ? :)
(May 13, 2012 02:13 PM)Gone With The Wind Wrote: :D, btw do you use NtReadFile for chrome?
Nah, I have a method to find the address of PR_Write without any byte pattern scanning (hint: there actually is a table inside the process memory which stores the absolute addresses of each PR_xxxx function which is easy to find if you know how ;) ) Therefore I hook PR_Write in every version of chrome ;)
(May 13, 2012 02:18 PM)pr0t0typ3 Wrote: Nah, I have a method to find the address of PR_Write without any byte pattern scanning (hint: there actually is a table inside the process memory which stores the absolute addresses of each PR_xxxx function which is easy to find if you know how ;) ) Therefore I hook PR_Write in every version of chrome ;)
Yeah I've known some people to use that methods but I personally went for NtReadFile as I can then use my hooking method that I use for ntdll based hooks. Only thing is PR_Write hook will be way more efficient and faster because it isn't just HTTP requests in NtReadFile buffer, it literally transfers gigabytes of crap.
(May 13, 2012 02:24 PM)Gone With The Wind Wrote: Yeah I've known some people to use that methods but I personally went for NtReadFile as I can then use my hooking method that I use for ntdll based hooks. Only thing is PR_Write hook will be way more efficient and faster because it isn't just HTTP requests in NtReadFile buffer, it literally transfers gigabytes of crap.
My focus was speed as well as bin size and as the Chrome PR_Write is pretty much the same as the FF one I can reduce the size :)
(May 13, 2012 02:36 PM)pr0t0typ3 Wrote: My focus was speed as well as bin size and as the Chrome PR_Write is pretty much the same as the FF one I can reduce the size :)
Yeah i was going to say, you could use 1 log routine for both.
