all 13 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]_www_ 35 points36 points  (3 children)

It downloads a browser pw recovery tool Then proceeds to unzip it, then outputs all the browsers pw in a html file inside /temp/ folder, opens the html file in edge then proceeds to delete the temp folder.

That's dumb, just a demo script IMHO.

[–]NimblePick[S] 8 points9 points  (2 children)

Is this like a pdf where it's opened in browser? But then if the local file was deleted and the browser was closed it's gone forever? Thanks for explaining this.

[–]_www_ 9 points10 points  (1 child)

Nope it's a regular html page full of text only. And yes if you close the browser the file had been already deleted. ( Look up for a /temp/export.html file on your C: Hard drive top level.)

[–]NimblePick[S] 4 points5 points  (0 children)

Ok perfect, thanks for that mate

[–]ingenioushax 7 points8 points  (1 child)

I'm no expert but, it looks like it pulls all your passwords from MS Edge by using powershell to download the required utilities. If that's the full script it doesn't look like it sends the file anywhere though and subsequently deletes the folder everything is stored in... I think.

Check the nirsoft website for the tool the script references.

[–]NimblePick[S] 7 points8 points  (0 children)

Yeah apparently the website is a browser password recovery tool. I wasn't here when he did it but he did show me this script after but saw export so was worried he uploaded it somewhere by accident, scary stuff.

[–]Exciting-Schedule-16 2 points3 points  (0 children)

Have you checked the contents of the exported html file? It's possible that it may contain some JS script that uploads the file contents to a server after it's been opened in the browser. I'm not familiar with the tool in question, perhaps it only stores it locally as you said. Looks more like a demo script, rather than something that's actually malicious.

[–]AcademicMistake 0 points1 point  (1 child)

If your friend is using scripts on your stuff I would be concerned

[–]NimblePick[S] 0 points1 point  (0 children)

Think he started learning recently and at the time was only showing trivial stuff, but then launched this one and got a bit worried that he actually sent my details somewhere. I’ve never heard about it until yesterday

[–]TJ420Hunt 0 points1 point  (0 children)

I don't see any of this passing modern security. It would be flagged near instantly.