RepentanceStealer

KO | EN

gitlite — search

#codex #automation #c #video #vue #large-language-models #pdf #containers #web #hacktoberfest

RepentanceStealer

(★ 9)

x64 PIC shellcode that enable chrome CDP in-memory and extract/exfiltrate cookies

File Explorer

ZIP Download

- cdp.h
- common.h
- core.h
- net.h
- resolver.h
- utils.h
- injector.c
- README.md
- encrypt.py
- hash.py
- HttpsSrv.py
- ws.py
- cdp.c
- debug.c
- entry.c
- net.c
- resolver.c
- utils.c
Makefile
README.md
shellcode.ld

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Windows x64 PIC shellcode enables Chrome Debugging Protocol in-memory and uses it for cookies extraction/exfiltration

## Architecture
- `/Loader/` Loads the shellcode inside chrome.exe process and execute it using special APCs
- `/src/` Core shellcode implementation
- `/script/` Varius utilities

## How to use it
- Use `/script/HttpsSrv` HTTPS server
- Inside `/src/cdp.c` change `C2_PORT` if needed and regenerate an encrypted `sC2Host` with `/script/encrypt.py`
- Compile the project using the makefile
- On a Windows machine open chrome and execute `.\Loader.exe .\repentance.x64.bin`
- CDP will be enabled and cookies sended to the specified C2 server

## How it works
entry.c contains the main logic for enabling CDP in memory, normally when `--remote-debugging-port` is used to spawn chrome with CDP enabled chrome calls `DevToolsAgentHost::StartRemoteDebuggingServer` ( [see here](https://source.chromium.org/chromium/chromium/src/+/main:content/browser/devtools/devtools_agent_host_impl.cc) ). We do the same thing, scan chrome.dll for `StartRemoteDebuggingServer`, `Chrome!malloc` and `TCPServerSocketFactory::CreateForHttpServer` bytes signature. 
`StartRemoteDebuggingServer` expects a  `DevToolsSocketFactory` vftable as argument, we can find it by using the address of `CreateForHttpServer` and search for that through the .rdata section of chrome.dll

Once its done we can allocate memory using `chrome!malloc` and craft the Factory object with this layout
    
    +0x00: [vtable_addr]  → points to TCPServerSocketFactory::`vftable' in .rdata
    +0x08: [0x240E]       → 9222 -> port_

The shellcode will than spawns a  worker thread that: does `GET /json/version` -> extract `webSocketDebuggerUrl` and uuid -> craft target path `/devtools/browser/<uuid>` -> Sends ws request `{"id":1,"method":"Storage.getCookies}`

The shellcode has alredy some **built-in evasion features like string encryption, API hashing and PEB obfuscation**

## Known limitation
CDP enabling is merely byte scanning, i have done some testing across major builds of chrome but not on other chromium based browsers. Tested builds:
- 153.0.8010.12
- 152.0.7977.64
- 151.0.7922.138
- 150.0.7871.124
- 149.0.7827.155
- 148.0.7778.178
- 147.0.7727.117
- 146.0.7680.165
- 145.0.7632.117

RepentanceStealer

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README