How To Extract Plaintext Google Chrome Passwords 

i mean no matter where you store it people can just find it and look for it inside of their script

@@Luna5829 Encryption keys be generated from text, so in reality the can store locally with a password as the encryption key. Also when the browser is online it can use the browsers company servers, so no need to use a local copy in that scenario anyway.

For your convenience of course

@@retzerR Can you imagine how ticked someone would be if the internet went down and their ISP asked them to log in to their router but the browser stored the encryption keys exclusively in the cloud? I don't think any do that.

@@jmr Good point, but they can also be stored locally, just with a password used to generate the encryption key, which is never stored. At least then the password will have to be brute forced, or social engineered

This is why you use hardware encryption keys, or other 2fa for everything, including browser based password systems

@@JeremyPatMartin what do you recommend? I want to have a hardware kinda thing to store my passwords , thank you

I commented before your last paragraph then realised it said the same thing 😂

The weakness looks a LOT like windows instead of chrome. Don't save your chrome passwords locally on a windows machine

where it belongs. in the corner. an eternity in the time-out corner.

😢

Imagine using IE 😂

​@_GhostMiner Edge is better than chrome, has been for a while.

To be honest on most sites you can just copy paste the password from the password field of the website into any text field.

@@UNagano589 🤣😂😂

You're right in some contexts, but it needs more precision; you can undo many blurring effects and you can undo some pixelated censors. The vulnerable pixelated censors are the ones using many pixels to censor the content, king of like a pixelated "low res blur effect", so to speak. In this context, the one John is using uses whole squares, which does not seem to leak info from under, so I'd reckon it is not vulnerable to that attack vector. I personally would censor using a plain color bar, as it is never affected by that attack.

Wasn’t it also just brute-forcing instead of decrypting? Think of the pixelated blur as something like a one-way hash function: blurring the same text results in the same pixel values, but reversing is hard.

@@blablubb1234 imagine a two-way hash function

Depix, for example, if I remember correctly. But yeah, unlikely tp work here.

that only works with shitty pixelated censoring.

I haven't seen this work in quite a long time.

​@@parkerlreedI have been successfully using this method for 10 years on chrome, last time was yesterday

@@parkerlreed it does still work i think

yep, it still does work...

What this video can help with is when can pull someone password files to your pc( using powershell script, for example) or when you get a shell access only

How sir ?

That will work up to a point; with a Live OS, anything unencrypted on the disk can be read. BitLocker / Password protected browsers can help though.

Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData

OSX location = /Library/Application Support/Google/Chrome/Profile/Login Data Linux = /home/{user}/.config/google-chrome/Default/Login Data Encryption key stored differently as well.

More accurately, the script needs to run in the same security context as the target user (having local administrator privileges on the same computer is insufficient). Let's say you have/gain physical access to a user's computer, but you can't and/or don't want to sign on as them. Assuming Windows: maybe you don't know/have their Windows password and you don't want to change it to a known password. You boot the system with something like Hiren's and set a password on and enable the built-in administrator account, then boot the computer and sign on with the built-in administrator account. Even after tweaking the script to target the user's (not built-in administrator) Chrome, you will see a message something like, "(-2146893813, 'CryptUnprotectData', 'Key not valid for use in specified state.') [ERR] Chrome secretkey cannot be found."

Definitely. That's the method I personnally use when I forget my own passwords.

You can just go to settings and view the passwords.

@@sven5666 Yeah, but to me personnally the Developer tools method is just faster.

@@sven5666 For that you need to know the system pw usually, this way u don't even need that.

@@kryptos1411 sounds good, thanks :)

To decrypt Edge modify the python script, replace global constant: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) With Edge path: EDGE_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE'])) EDGE_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) and then change CHROME to EDGE in the rest of script where paths are being referenced.

Up 🙏🍀

It can be downloaded and than also decrypted on your own machine. Very easily! Do avoid it put a master password - that do a little bit harder to decrypt all your saved passwords. The bad person need first the master password - bruteforce but If you choose a very long Password for that, than it takes years to bruteforce it. But Choose your own password managment system what do you like. 100% Safty is not given in the IT-World.

Yes that user needs to be currently logged on.

Encrypting makes it slightly more difficult to steal the data rather than storing it directly in plaintext in a file.

software that wants access to the keyring always has to ask for permission from the user first (at least the first time) even if it is unlocked afaik

8:51 Same for me, the exact same- URL, User Name there but Password is blank. It also shows 'utf-8' codec can't decode byte 0xf4 in position 0: invalid continuation byte [ERR] Unable to decrypt, Chrome version

i agree

what do you mean? I think found malware that grabbed chrome passwords

How does master password this work?

i mean it can just read out the key right? but the IV as well?

no every encryption key is different. the script reads the local_state file in chrome directory and extracts the encryption_key, then reads the login.sqlite data to extract the ciphertext and the IV that is all that is required to decrypt passwords. Same technique works for credit cards as well.

I think no matter where you install the browser, that these extra files are always stored in that directory 🤔 and if you changed it they might just scan the whole file system for it

script works for all Chromium browsers on windows Chrome,Microsoft Edge,Brave,Opera just need to change browser directory

Default path defined in script: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data"%(os.environ['USERPROFILE'])) If you need a custom path you can modify it.

which means any malicious programs you run can access it. Tip: dont run games on your main account or even your main computer.

python script extracts the encryption_key from Local state json file to decrypt the ciphertext stored in Login Data database. sqlite db is not encrypted.

"thank you for your work"? did i get that right without a translator? :o

@@kipchickensout yup

@@kipchickensout yes(da)

nice:)

Python makes it easier

@@kodiererg sure it does

Works for browser versions 80+

Credit cards are stored in the file Web Data

@@webofchaos2684 Thx for the answer.

Almost certainly yes. No reason they wouldnt be and it makes sense to use the same encryption standard besides anything else it would take unnecessary dev time to impliment a separate encryption standard for linux Edit: that answer was talking about chrome on linux but yeah edge and firefox use aes

On linux the key used to encrypt passwords is typically stored in a wallet, like kwallet or gnome keyring. On my system for example, it's stored in kwallet, which is itself encrypted with my GPG key. So I have to type in the password to my GPG key after I log in.

Chromium Browsers in Linux are just as bad uses default password 'peanuts' and salt 'saltysalt' you can just build a AES decrypter in python.

@@webofchaos2684 not true: if either gnome-keyring or kwallet are running, Chromium will generate a random 16-byte key and store it in the keyring.

@@e995a1ad you can bypass the key ring by using the default password and salt hashing it with AES-128-cbc method.

If a user has master password set your only option is to brute force the password.

​@@webofchaos2684That's what i was thinking but he said it's possible to crack Firefox. Maybe he just meant the vanilla version with no master pass.

Think he may be referring to Firefox without a master password set. All passwords and encryption key are stored in the key3.db file which is decrypt-able when no password is applied.

Password length does not matter. Character length can be 300 characters long. encryption key is stored locally so decrypting passwords and other information can always be done.

@@webofchaos2684 Having an encryption key is not the same as having a hash, right? I forgot the password to one of my rar file. I was wondering if I could get the hash is it possible to break that to recover the password.

@@DayzGone no they are not the same a hash is an encrypted output of the password. If you have a hash of the password of the rar file it's possible to bruteforce the hash to get the password assuming the length is not too long.

Also if someone has access to your local FS, you have bigger problems...

He JUST showed what a bad idea that is.

@@jdspecht682 Well... Lets say someone broke into your house, and ate your cake from the refrigerator(Chrome passwords). Would you be worried about that cake or that someone broke into your house? I think simmilar thing happens to storing passowords in browser's password managers. If attacker can access those files(chrome's), your machine is already compromised. I believe browsers password managers are not that bad after all :)

This attack works on Windows,OSX, Linux and Chromebook, have not tried this on Android or IOS yet.