Cookie-Monster: BOF to steal browser cookies & credentials
Cookie-Monster
Steal browser cookies for Edge, Chrome, and Firefox through a BOF or exe! Cookie-Monster will extract the WebKit master key, locate a browser process with a handle to the Cookies and Login Data files, copy the handle(s), and then filelessly download the target. Once the Cookies/Login Data file(s) are downloaded, the Python decryption script can help extract those secrets! Firefox module will parse the profiles.ini and locate where the logins.json and key4.db files are located and download them. A seperate github repo is referenced for offline decryption.
BOF Usage
Usage: cookie-monster [ –chrome || –edge || –firefox || –chromeCookiePID <pid> || –chromeLoginDataPID <PID> || –edgeCookiePID <pid> || –edgeLoginDataPID <pid>]
cookie-monster Example:
cookie-monster –chrome
cookie-monster –edge
cookie-moster –firefox
cookie-monster –chromeCookiePID 1337
cookie-monster –chromeLoginDataPID 1337
cookie-monster –edgeCookiePID 4444
cookie-monster –edgeLoginDataPID 4444
cookie-monster Options:
–chrome, looks at all running processes and handles, if one matches chrome.exe it copies the handle to Cookies/Login Data and then copies the file to the CWD
–edge, looks at all running processes and handles, if one matches msedge.exe it copies the handle to Cookies/Login Data and then copies the file to the CWD
–firefox, looks for profiles.ini and locates the key4.db and logins.json file
–chromeCookiePID, if chrome PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file
–chromeLoginDataPID, if chrome PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file
–edgeCookiePID, if edge PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file
–edgeLoginDataPID, if edge PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file
EXE usage
Cookie Monster Example:
cookie-monster.exe –all
Cookie Monster Options:
-h, –help Show this help message and exit
–all Run chrome, edge, and firefox methods
–edge Extract edge keys and download Cookies/Login Data file to PWD
–chrome Extract chrome keys and download Cookies/Login Data file to PWD
–firefox Locate firefox key and Cookies, does not make a copy of either file
