slyd0g/WhiteChocolateMacademiaNut

Stars
149
Rank 248,619 (Top 5 %)
Language
Go
Created almost 4 years ago
Updated over 1 year ago

slyd0g/WhiteChocolateMacademiaNut

slyd0g

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Interact with Chromium-based browsers' debug port to view open tabs, installed extensions, and cookies

WhiteChocolateMacademiaNut

Description

Interacts with Chromium-based browsers' debug port to view open tabs, installed extensions, and cookies. Tested against Google Chrome and Microsoft Edge.

Blogpost

https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e

Usage

Dump the user's open tabs and installed extensions
- ./WhiteChocolateMacademiaNut -p 4200 -d pages
Dump the user's cookies in human-readable format
- ./WhiteChocolateMacademiaNut --port 1337 --dump cookies --format human
Dump the user's cookies in raw JSON as returned by Chromium (compatible with EditThisCookie extension)
- ./WhiteChocolateMacademiaNut --port 1234 --dump cookies --format raw
Dump the user's cookies in JSON with the name, value, domain, path, and modified expirationDate attribute to 10 years in the future (compatible with Cookiebro extension)
- ./WhiteChocolateMacademiaNut -p 666 -d cookies -f modified
Dump the user's cookies in JSON if the cookie name or domain field contains github and modifies the expirationDate attribute
- ./WhiteChocolateMacademiaNut -p 4321 -d cookies -f modified -g github
Dump the user's cookies in human-readable format if the page title or url contains facebook
- ./WhiteChocolateMacademiaNut --port 31415 --dump pages --grep facebook

Load and clear functions are intended to be used locally. Do not clear target's cookies. In order for this to work, you will need to start the Chromium-based browser with the debug port open.

Load the user's cookies locally from a file
- ./WhiteChocolateMacademiaNut --port 9222 --load cookies.json
Clear all cookies
- ./WhiteChocolateMacademiaNut --port 9222 --clear

References

DLLHijackTest

DLL and PowerShell script to assist with finding DLL hijacks

PrimaryTokenTheft

Steal a primary token and spawn cmd.exe using the stolen token

SharpClipboard

C# Clipboard Monitor

UrbanBishopLocal

A port of FuzzySecurity's UrbanBishop project for inline shellcode execution

SwiftSpy

macOS keylogger, clipboard monitor, and screenshotter

SwiftInMemoryLoading

Swift implementation of in-memory Mach-O loading on macOS

LNKMod

C# project to create or modify existing LNKs

TimeStomper

PoC that manipulates Windows file times using SetFileTime() API

ObjCShellcodeLoader

macOS shellcode loader written in Objective-C

SK8RAT

C++ implant that interfaces with a SK8PARK server

SharpCrashEventLog

C# port of LogServiceCrash

DylibHijackTest

Discover DYLD_INSERT_LIBRARIES hijacks on macOS

SwiftParseTCC

Use "Full Disk Access" permissions to read the contents of TCC.db and display it in human-readable format

SK8PARK

Python 3 server used to control SK8RAT implant

SharpRoast-Parser

Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.

XORShellcodeLoader

Loads shellcode from a resource file.

SwiftLiverpool

Enumerate Location Services using CoreLocation API on macOS

pwnVNC

Python script that will attempt connection to unauthenticated VNC sessions on the entire Internet and take a screenshot of the user's current session.

SharpCryptUnprotectData

C-Sharp-Out-Minidump

C# implementation of Out-Minidump.ps1

SwiftPlist

Partial rewrite of the `plutil` utility on macOS

MiniShare-1.4.1-RCE

MiniShare 1.4.1 remote buffer overflow leading to RCE.

Debian8JessieSetup

Run on a fresh install of Debian 8 Jessie to create a new user, give sudo privileges, update your system, update your source list and more!

TestingDLL

TestingDLL using ShellExecuteA to spawn processes

XORcipher

Script will ask you to encrypt or decrypt a message by XORing the message with a OTP.