Pillager is a tool for exporting and decrypting useful data from target computer.
Browser Name | BookMarks | Cookies | Passwords | Historys | Local Storage | Extension Settings |
---|---|---|---|---|---|---|
IE | ✅ | ❌ | ✅ | ✅ | ❌ | ❌ |
Edge | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Chrome | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Chrome Beta | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Chrome SxS | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Chromium | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Brave-Browser | ✅ | ✅ | ✅ | ✅ | 🚧 | 🚧 |
QQBrowser | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
SogouExplorer | ✅ | ✅ | ✅ | ✅ | 🚧 | 🚧 |
360Chrome | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ |
360ChromeX | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ |
Vivaldi | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
CocCoc | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Torch | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Kometa | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Orbitum | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
CentBrowser | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
7Star | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Sputnik | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Epic Privacy | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Uran | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Yandex | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Opera | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
Opera GX | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
FireFox | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
✅ Support,🚧 Haven't Tested,❌ Not Support
- Acount Takeover
- Telegram
- Skype
- Enigma
- DingTalk
- Line
- Discord
- MailMaster
- Foxmail
- FileZilla
- Password Recovery
- MobaXterm
- Xmanager
- RDCMan
- FinalShell
- Navicat
- SQLyog
- SecureCRT
- Outlook
- MailBird
- WinSCP
- DBeaver
- CoreFTP
- Snowflake
- Personal Infomation
- VSCode
- Netease CloudMusic
Will add more ......
- Wifi
- ScreenShot
- InstalledApp
This project uses Github Action to auto build and upload the Release
- Pillager.exe is exe for .Net Framework v3.5
- Pillager.bin is shellcode built with Donut
- cs-plugin.zip is plugin for CobaltStrike
Pillager.exe is just for testing. It will be detect as malware by most Anti-Virus softwares.
Run the shellcode in your way, and find the result at %Temp%\Pillager.zip
.
- Shellcode file size is less than 100kb
- Using self version of Donut,shellcode is suitable for both .Net Framework v3.5/v4.x
Pillager has joined 404星链计划