Ejemplo n.º 1
0
    def main(self, regkeys, places, mkp, sid, h):
        values = {}

        urls = self.formatUrls(places)

        i = 0
        b = IE7.IE7Autocomplete()
        if b.try_decrypt_with_hash(h, mkp, sid, values=regkeys, urls=urls):
            for k in b.entries.keys():
                if b.entries[k].entropy is None:
                    continue
                e = b.entries[k]
                u = e.entropy.decode('UTF-16LE')[:-1]
                i += 1
                key = 'password%d' % i
                values[key] = {
                    'login': e.login,
                    'password': e.password,
                    'origin': u,
                    'domain': format(u)
                }
                for j in range(len(e.other)):
                    values[key]["secret%d" % j] = e.other[j]

        return {self.__class__.__name__: values}
Ejemplo n.º 2
0
    def main(self, indexes):
        placeValues = {}
        formValues = {}

        binary = '%s/msiecftools/msiecfexport' % MSIECF_DIR
        if not os.path.isfile(binary):
            print >> sys.stderr, "Binary %s not found" % binary
            return {
                self.__class__.__name__: {
                    'places': placeValues,
                    'forms': formValues
                }
            }

        i = 0
        for index in indexes:
            temp = tempfile.NamedTemporaryFile()
            subp.call([binary, index], universal_newlines=True, stdout=temp)
            temp.seek(0)
            url = ""
            date = ""
            for line in temp:
                if len(line) != 0 and line[-1] == '\n':
                    line = line[:-1]
                if line == "":
                    if url != "" and date != "":
                        i += 1
                        placeValues['place%d' % i] = {
                            'url': url,
                            'date': date,
                            'domain': format(url)
                        }
                    url = ""
                    date = ""
                    continue
                #FIXME: other "Location" that the "Visited" one but the other means less sense
                # Should be intereting to see if it's not forms or cookies related
                match = re.match(r'^Location[^:]*: Visited:[^@]*@(.*)$', line)
                if match != None:
                    url = match.group(1)
                match = re.match(r'^Primary filetime[^:]*: (.*)$', line)
                if match != None:
                    date = match.group(1)
            temp.close()

        return {
            self.__class__.__name__: {
                'places': placeValues,
                'forms': formValues
            }
        }
Ejemplo n.º 3
0
    def main(self, history):
        placeValues = {}
        formValues = {}

        places = cfp.CFPropertyList(history)
        places.load()
        places = cfp.native_types(places.value)
        i = 0
        for place in places.get('WebHistoryDates', []):
            i += 1
            placeValues['place%d' % i] = {'url':place[''], 'title':place['title'],
                'count':place['visitCount'], 'date':place['lastVisitedDate'],
                'domain':format(place[''])}

        return {self.__class__.__name__:{'places':placeValues, 'forms':formValues}}
Ejemplo n.º 4
0
    def main(self, indexes):
        placeValues = {}
        formValues = {}

        binary = '%s/msiecftools/msiecfexport' % MSIECF_DIR
        if not os.path.isfile(binary):
            print >>sys.stderr, "Binary %s not found" % binary
            return {self.__class__.__name__:{'places':placeValues, 'forms':formValues}}

        i = 0
        for index in indexes:
            temp = tempfile.NamedTemporaryFile()
            subp.call([binary, index], universal_newlines=True, stdout=temp)
            temp.seek(0)
            url = ""
            date = ""
            for line in temp:
                if len(line) != 0 and line[-1] == '\n':
                    line = line[:-1]
                if line == "":
                    if url != "" and date != "":
                        i += 1
                        placeValues['place%d' % i] = {'url':url, 'date':date,
                            'domain':format(url)}
                    url = ""
                    date = ""
                    continue
                #FIXME: other "Location" that the "Visited" one but the other means less sense
                # Should be intereting to see if it's not forms or cookies related
                match = re.match(r'^Location[^:]*: Visited:[^@]*@(.*)$', line)
                if match != None:
                    url = match.group(1)
                match = re.match(r'^Primary filetime[^:]*: (.*)$', line)
                if match != None:
                    date = match.group(1)
            temp.close()

        return {self.__class__.__name__:{'places':placeValues, 'forms':formValues}}
Ejemplo n.º 5
0
    def main(self, history):
        placeValues = {}
        formValues = {}

        places = cfp.CFPropertyList(history)
        places.load()
        places = cfp.native_types(places.value)
        i = 0
        for place in places.get('WebHistoryDates', []):
            i += 1
            placeValues['place%d' % i] = {
                'url': place[''],
                'title': place['title'],
                'count': place['visitCount'],
                'date': place['lastVisitedDate'],
                'domain': format(place[''])
            }

        return {
            self.__class__.__name__: {
                'places': placeValues,
                'forms': formValues
            }
        }
Ejemplo n.º 6
0
    def main(self, regkeys, places, mkp, sid, h):
        values = {}

        urls = self.formatUrls(places)

        i = 0
        b = IE7.IE7Autocomplete()
        if b.try_decrypt_with_hash(h, mkp, sid, values=regkeys, urls=urls):
            for k in b.entries.keys():
                if b.entries[k].entropy is None:
                    continue
                e = b.entries[k]
                u = e.entropy.decode("UTF-16LE")[:-1]
                i += 1
                key = "password%d" % i
                values[key] = {"login": e.login, "password": e.password, "origin": u, "domain": format(u)}
                for j in range(len(e.other)):
                    values[key]["secret%d" % j] = e.other[j]

        return {self.__class__.__name__: values}