slacksploit.py

import os, sys, time
import platform, getpass
import csv
import ccl_leveldb
import pathlib

banner = '''
  _____ _            _              _       _ _   
 / ____| |          | |            | |     (_) |  
| (___ | | __ _  ___| | _____ _ __ | | ___  _| |_ 
 \___ \| |/ _` |/ __| |/ / __| '_ \| |/ _ \| | __|
 ____) | | (_| | (__|   <\__ \ |_) | | (_) | | |_ 
|_____/|_|\__,_|\___|_|\_\___/ .__/|_|\___/|_|\__|
                             | |                  
                             |_|                  
'''
ENCODING = "iso-8859-1" # Encoding for parsing and dumping the leveldb contents into CSV


def dumb_leveldb(input_path):
    output_path = input_path.split("/")[-2] + "dump.csv"

    print("Parsing the leveldb files from "+input_path)

    leveldb_records = ccl_leveldb.RawLevelDb(input_path)

    with open(output_path, "w", encoding="utf-8", newline="") as file1:
        writes = csv.writer(file1, quoting=csv.QUOTE_ALL)
        writes.writerow(
            [
                "key-hex", "key-text", "value-hex", "value-text", "origin_file",
                "file_type", "offset", "seq", "state", "was_compressed"
            ])

        for record in leveldb_records.iterate_records_raw():
            writes.writerow([
                record.user_key.hex(" ", 1),
                record.user_key.decode(ENCODING, "replace"),
                record.value.hex(" ", 1),
                record.value.decode(ENCODING, "replace"),
                str(record.origin_file),
                record.file_type.name,
                record.offset,
                record.seq,
                record.state.name,
                record.was_compressed
            ])
    print("The leveldb content has been written into "+output_path)


if __name__ == '__main__':

    print(banner)



    leveldb_locations = ["/mnt/c/Users/clouduser/Desktop/21115-Session Storage"]

    print("Examining LevelDB Files")

    for loc in leveldb_locations:
        dumb_leveldb(loc)