Using Google Dorks to find open directories occupies a complex legal gray area. Simply searching for publicly available information on Google is generally legal. However, the moment you download, access, or attempt to use leaked credentials or hacking tools found within those directories, you cross into criminal territory.
The vast majority of files labeled as "Facebook password repacks" or password recovery tools are malware in disguise. When a user downloads and extracts these files, they often execute: intitle index of password facebook repack