Pillager is a tool for exporting and decrypting useful data from target computer.
| Browser Name | BookMarks | Cookies | Passwords | Historys | Local Storage | Extension Settings |
|---|---|---|---|---|---|---|
| IE | ✅ | ❌ | ✅ | ✅ | ❌ | ❌ |
| Edge | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Chrome | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Chrome Beta | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Chrome SxS | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Chromium | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Brave-Browser | ✅ | ✅ | ✅ | ✅ | 🚧 | 🚧 |
| QQBrowser | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| SogouExplorer | ✅ | ✅ | ✅ | ✅ | 🚧 | 🚧 |
| 360Chrome | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ |
| 360ChromeX | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ |
| Vivaldi | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| CocCoc | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Torch | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Kometa | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Orbitum | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| CentBrowser | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| 7Star | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Sputnik | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Epic Privacy | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Uran | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Yandex | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Opera | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| Opera GX | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 | 🚧 |
| FireFox | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
✅ Support,🚧 Haven't Tested,❌ Not Support
- Acount Takeover
- Telegram
- Skype
- Enigma
- DingTalk
- Line
- Discord
- MailMaster
- Foxmail
- FileZilla
- Teams
- Password Recovery
- MobaXterm
- Xmanager
- RDCMan
- FinalShell
- Navicat
- SQLyog
- SecureCRT
- Outlook
- MailBird
- WinSCP
- DBeaver
- CoreFTP
- Snowflake
- HeidiSQL
- Personal Infomation
- VSCode
- Netease CloudMusic
- Win10Ms_Pinyin
Will add more ......
- Wifi
- ScreenShot
- InstalledApp
- ClipBoard
- FileList
- RecentFile
- SystemInfo
- TaskList
This project uses Github Action to auto build and upload the Release
- Pillager.exe is exe for .Net Framework v3.5
- Pillager.bin is shellcode built with Donut
- cs-plugin.zip is plugin for CobaltStrike
Pillager.exe is just for testing. It will be detect as malware by most Anti-Virus softwares.
Run the shellcode in your way, and find the result at %Temp%\Pillager.zip.
- Shellcode file size is less than 100kb
- Using self version of Donut，shellcode is suitable for both .Net Framework v3.5/v4.x
Pillager has joined 404星链计划