diff --git a/core/common/output.go b/core/common/output.go index ed092c8..cbd9e2d 100644 --- a/core/common/output.go +++ b/core/common/output.go @@ -4,9 +4,10 @@ import ( "bytes" "encoding/json" "fmt" + "os" + "hack-browser-data/log" "hack-browser-data/utils" - "os" "github.com/jszwec/csvutil" ) diff --git a/core/common/parse.go b/core/common/parse.go index 8ce70c2..694e10c 100644 --- a/core/common/parse.go +++ b/core/common/parse.go @@ -4,14 +4,15 @@ import ( "bytes" "database/sql" "encoding/base64" - "hack-browser-data/core/decrypt" - "hack-browser-data/log" - "hack-browser-data/utils" "io/ioutil" "os" "sort" "time" + "hack-browser-data/core/decrypt" + "hack-browser-data/log" + "hack-browser-data/utils" + _ "github.com/mattn/go-sqlite3" "github.com/tidwall/gjson" ) @@ -244,9 +245,9 @@ func (h *History) ChromeParse(key []byte) error { func (c *Cookies) ChromeParse(secretKey []byte) error { cookie := cookies{} c.cookies = make(map[string][]cookies) - cookieDB, err := sql.Open("sqlite3", utils.Cookies) + cookieDB, err := sql.Open("sqlite3", ChromeCookies) defer func() { - if err := os.Remove(utils.Cookies); err != nil { + if err := os.Remove(ChromeCookies); err != nil { log.Error(err) } }() @@ -534,11 +535,11 @@ func getDecryptKey() (item1, item2, a11, a102 []byte, err error) { nssRows *sql.Rows ) defer func() { - if err := os.Remove(utils.FirefoxKey4DB); err != nil { + if err := os.Remove(FirefoxKey4DB); err != nil { log.Error(err) } }() - keyDB, err = sql.Open("sqlite3", utils.FirefoxKey4DB) + keyDB, err = sql.Open("sqlite3", FirefoxKey4DB) defer func() { if err := keyDB.Close(); err != nil { log.Error(err) diff --git a/core/decrypt/decrypt_linux.go b/core/decrypt/decrypt_linux.go index 516776a..24dee6c 100644 --- a/core/decrypt/decrypt_linux.go +++ b/core/decrypt/decrypt_linux.go @@ -11,14 +11,8 @@ import ( "golang.org/x/crypto/pbkdf2" ) -const ( - fireFoxProfilePath = "/home/*/.mozilla/firefox/*.default-release/" - fireFoxCommand = "" -) - var ( - chromeIV = []byte{32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32} - chromeSalt = []byte("saltysalt") + chromeIV = []byte{32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32} ) func ChromePass(key, encryptPass []byte) ([]byte, error) { diff --git a/core/decrypt/decrypt_windows.go b/core/decrypt/decrypt_windows.go index 1065c35..e0aabf1 100644 --- a/core/decrypt/decrypt_windows.go +++ b/core/decrypt/decrypt_windows.go @@ -14,47 +14,6 @@ import ( "golang.org/x/crypto/pbkdf2" ) -const ( - chromeProfilePath = "/AppData/Local/Google/Chrome/User Data/*/" - chromeKeyPath = "/AppData/Local/Google/Chrome/User Data/Local State" - edgeProfilePath = "/AppData/Local/Microsoft/Edge/User Data/*/" - edgeKeyPath = "/AppData/Local/Microsoft/Edge/User Data/Local State" - speed360ProfilePath = "/AppData/Local/360chrome/Chrome/User Data/*/" - speed360KeyPath = "" - qqBrowserProfilePath = "/AppData/Local/Tencent/QQBrowser/User Data/*/" - qqBrowserKeyPath = "" - firefoxProfilePath = "/AppData/Roaming/Mozilla/Firefox/Profiles/*.default-release/" - firefoxKeyPath = "" -) - -var ( - browserList = map[string]struct { - ProfilePath string - KeyPath string - }{ - "chrome": { - chromeProfilePath, - chromeKeyPath, - }, - "edge": { - edgeProfilePath, - edgeKeyPath, - }, - "360speed": { - speed360ProfilePath, - speed360KeyPath, - }, - "qq": { - qqBrowserProfilePath, - qqBrowserKeyPath, - }, - "firefox": { - firefoxProfilePath, - "", - }, - } -) - func ChromePass(encryptPass, key []byte) ([]byte, error) { if len(encryptPass) > 15 { // remove prefix 'v10' diff --git a/utils/utils.go b/utils/utils.go index e7786af..f1bb4a8 100644 --- a/utils/utils.go +++ b/utils/utils.go @@ -1,66 +1,17 @@ package utils import ( - "crypto/aes" - "crypto/cipher" - "crypto/des" - "encoding/asn1" "fmt" - "hack-browser-data/log" "io/ioutil" "os" "path" "path/filepath" "strings" "time" -) - -type DecryptError struct { - err error - msg string -} - -func (e *DecryptError) Error() string { - return fmt.Sprintf("%s: %s", e.msg, e.err) -} -func (e *DecryptError) Unwrap() error { - return e.err -} - -type Browser struct { - Name string - DataDir string -} - -const ( - LoginData = "Login Data" - History = "History" - Cookies = "Cookies" - Bookmarks = "Bookmarks" - FirefoxCookie = "cookies.sqlite" - FirefoxKey4DB = "key4.db" - FirefoxLoginData = "logins.json" - FirefoxData = "places.sqlite" - FirefoxKey3DB = "key3.db" + "hack-browser-data/log" ) - -func GetDBPath(dir string, dbName ...string) (dbFile []string) { - for _, v := range dbName { - s, err := filepath.Glob(dir + v) - if err != nil && len(s) == 0 { - continue - } - if len(s) > 0 { - log.Debugf("Find %s File Success", v) - log.Debugf("%s file location is %s", v, s[0]) - dbFile = append(dbFile, s[0]) - } - } - return dbFile -} - func CopyDB(src, dst string) error { locals, _ := filepath.Glob("*") for _, v := range locals { @@ -117,16 +68,6 @@ func TimeEpochFormat(epoch int64) time.Time { return t } -// check time our range[1.9999] -func checkTimeRange(check time.Time) time.Time { - end, _ := time.Parse(time.RFC3339, "9000-01-02T15:04:05Z07:00") - if check.Before(end) { - return check - } else { - return end - } -} - func ReadFile(filename string) (string, error) { s, err := ioutil.ReadFile(filename) return string(s), err @@ -152,74 +93,3 @@ func MakeDir(dirName string) { err = os.Mkdir(dirName, 0700) } } - -func PaddingZero(s []byte, l int) []byte { - h := l - len(s) - if h <= 0 { - return s - } else { - for i := len(s); i < l; i++ { - s = append(s, 0) - } - return s - } -} - -func PKCS5UnPadding(src []byte) []byte { - length := len(src) - unpadding := int(src[length-1]) - return src[:(length - unpadding)] -} - -func Des3Decrypt(key, iv []byte, src []byte) ([]byte, error) { - block, err := des.NewTripleDESCipher(key) - if err != nil { - log.Error(err) - return nil, err - } - blockMode := cipher.NewCBCDecrypter(block, iv) - sq := make([]byte, len(src)) - blockMode.CryptBlocks(sq, src) - return sq, nil -} - -/* -SEQUENCE (3 elem) - OCTET STRING (16 byte) - SEQUENCE (2 elem) - OBJECT IDENTIFIER 1.2.840.113549.3.7 des-EDE3-CBC (RSADSI encryptionAlgorithm) - OCTET STRING (8 byte) - OCTET STRING (16 byte) -*/ -type LoginPBE struct { - CipherText []byte - SequenceLogin - Encrypted []byte -} - -type SequenceLogin struct { - asn1.ObjectIdentifier - Iv []byte -} - -func DecodeLogin(decodeItem []byte) (pbe LoginPBE, err error) { - _, err = asn1.Unmarshal(decodeItem, &pbe) - if err != nil { - log.Error(err) - return - } - return pbe, nil -} - -func aes128CBCDecrypt(key, iv, encryptPass []byte) ([]byte, error) { - - block, err := aes.NewCipher(key) - if err != nil { - return []byte{}, err - } - dst := make([]byte, len(encryptPass)) - mode := cipher.NewCBCDecrypter(block, iv) - mode.CryptBlocks(dst, encryptPass) - dst = PKCS5UnPadding(dst) - return dst, nil -}