How To Extract Plaintext Google Chrome Passwords
ฝัง
- เผยแพร่เมื่อ 11 มิ.ย. 2023
- j-h.io/passbolt || Use a password manager to keep all your credentials secure -- my code JOHN-HAMMOND will save 20% off!! j-h.io/passbolt
AND HEY COME PLAY NAHAMCON CTF THIS WEEKEND ctf.nahamcon.com/
🔥 TH-cam ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
Browsers: don't worry, we encrypt all of your passwords to keep them safe!
Also browsers: we store the encryption key right beside your passwords!
i mean no matter where you store it people can just find it and look for it inside of their script
@@Luna5829 Encryption keys be generated from text, so in reality the can store locally with a password as the encryption key. Also when the browser is online it can use the browsers company servers, so no need to use a local copy in that scenario anyway.
For your convenience of course
@@retzerR Can you imagine how ticked someone would be if the internet went down and their ISP asked them to log in to their router but the browser stored the encryption keys exclusively in the cloud? I don't think any do that.
@@jmr Good point, but they can also be stored locally, just with a password used to generate the encryption key, which is never stored. At least then the password will have to be brute forced, or social engineered
Moral of the story don't save passwords in the browser, awesome video John love your content.
John, you explain in a way that is very understandable something so many people dont have the time/skills to do.I enjoy not only watching your vodeos but also just listening as you explain thoroughly i can almost visualise what you are doing.I hope you get to where you deserve to be pal !!!
...and this is WHY scam-baiters are constantly telling ppl to NOT store passwords in the browser! Awesome vid John!
This is why you use hardware encryption keys, or other 2fa for everything, including browser based password systems
@@JeremyPatMartin what do you recommend? I want to have a hardware kinda thing to store my passwords , thank you
So I have to leave the comment to let you know that you've helped so much. True could have happened with any video but just happened to hit yours first. My uncle passed away a week or so ago and he had a lot of cherished memories stored in his phone and laptop, I've learned to get through the windows password the pash couple of days probably through the least direct wya but this helped me to guess what his phone password was and get the remaining memories. Thank you for making the video and helping me recover the cherished memories.
Always informative
Passbolt (and any other password manager) employs the similar mechanisms for storing and sharing passwords as your browser password manager, it just has a robust feature set for sharing the password with others. Don't get lazy and believe any password manager is a golden bullet.
Passwords are stored using a cipher, which will take a long time to break if you were to brute force it, but the key to the cipher needs to be kept on your local machine in order to access them.
The best way to protect yourself is to use multiple layers of authentication. 2FA authenticator applications, NFC tags, biometrics. Separate storage or data mediums that can have a hash created, so only the medium itself is a way to authenticate. Employ good practice and having multiple layers of security is the best way to keep you and your data protected.
I commented before your last paragraph then realised it said the same thing 😂
I was actually intrigued when i saw passbolt sponsor this video, cause i switched to them from lastpass about 3 months ago..honestly yes, best pw manager i can say
Internet explorer crying in the corner
The weakness looks a LOT like windows instead of chrome. Don't save your chrome passwords locally on a windows machine
where it belongs. in the corner. an eternity in the time-out corner.
😢
Imagine using IE 😂
@_GhostMiner Edge is better than chrome, has been for a while.
I learned this a long time ago. You can very easily make a vba macro that can email you all of someone's Chrome passwords in clear text.
Awesome content and very informative! 🙌
I'd love to see some timelines on your videos John! :)
Almost any password vault is vulnerable to local attacks. Unless you're typing something in when you go to log into a website, there's a guaranteed way to retrieve that password if you have local access. Even if you have to go to the website and wait for the tool to fill in the password field, you can get it once the password field is filled out in the browser with a trivial console command.
To be honest on most sites you can just copy paste the password from the password field of the website into any text field.
@@UNagano589 🤣😂😂
I really appreciate your content it is really helpful. And is there any way of decrypting those chrome passwords on another machine?
I will gladly follow along, thanks for the invitation, John!
Thank you JH 🙏
Your sponsor is awesome 🤩
not just saved passwords, we can easily access logged in sessions using cookies. if u get system u get everything
Amazing video🎉
Why am I only now hearing about Passbolt? It sounds like something everyone I talk to would talk about.
A easier solution is to go to the website of the stored password, let it auto fill it, and change the HTML to show the starred contents.
I haven't seen this work in quite a long time.
@@parkerlreedI have been successfully using this method for 10 years on chrome, last time was yesterday
@@parkerlreed it does still work i think
yep, it still does work...
What this video can help with is when can pull someone password files to your pc( using powershell script, for example) or when you get a shell access only
Thanks dude!
I've yet to see a "password manager" that I feel entirely comfortable with. Ultimately your passwords have to be stored on something physical. Even if in encrypted form, they're only as good as the encryption key/password used to encrypt them. And how do you store that? You're down to memory versus sticky notes, and master passwords are a vulnerability in themselves. Thoughts?
I was looking for this thing.. thanks John
What detection rules would you recommend for such cases ? Any specific eventid or something ?
Fun fact your card details are also stored in these databases, albeit without the cvv code. An attacker can also grab your auto fill data such as addresses,ssn,phone numbers etc
Nice John :D
Careful, I remember there was some algorithm that can decrypt pixelated censor and it is really good at it, hope you changed your other user password after this
You're right in some contexts, but it needs more precision; you can undo many blurring effects and you can undo some pixelated censors.
The vulnerable pixelated censors are the ones using many pixels to censor the content, king of like a pixelated "low res blur effect", so to speak. In this context, the one John is using uses whole squares, which does not seem to leak info from under, so I'd reckon it is not vulnerable to that attack vector.
I personally would censor using a plain color bar, as it is never affected by that attack.
Wasn’t it also just brute-forcing instead of decrypting? Think of the pixelated blur as something like a one-way hash function: blurring the same text results in the same pixel values, but reversing is hard.
@@blablubb1234 imagine a two-way hash function
Depix, for example, if I remember correctly. But yeah, unlikely tp work here.
that only works with shitty pixelated censoring.
This is why it's important to secure your OS login! For the convenience that the browser's password manager offers, like those on your phone, you have to ensure your OS login is secure and to not leave it unlocked. Treat it like you would your phone.
Of course, this assumes other users of the device aren't admins. And I do think Chrome should find a way to avoid storing the cryptographic key in the cloud and off the local device, even if that requires re-authenticating with Google every time you launch your browser - it should at least be an option.
That will work up to a point; with a Live OS, anything unencrypted on the disk can be read. BitLocker / Password protected browsers can help though.
And thats why I dont save passwords anywhere. I have a password algorithm in my head that creates a random string pass, upper/lower case, numbers, etc for each site. Don't need to remember them that way. If it ends up on a hacked password dump, it won't work on any other site and looks like a long random string.
Nice and thanks for sharing. What is the impact / possibility if the encryption key of the local password storage is "protected" by a master password (Let's assume it is complex or is a long-assed pass phrase) would that be a mitigation for local storage attacks?
Thanks for this excellent video. After seen it, I wonder how do you know the location and lenght of the initialization vector [3:15]. I did not get where do you obtain it from. Also, how to you know the lenght of the encryted password itself [15:-16]. That was also unclear to me. Once you get those, the rest of the work seems to be pretty straightforward... Thanks again!
I thought this was pssible. Thanks John.
is the masterpassword on firefox an easiest solution ? doesn't use the masterpw to encrypt ?
thank you in advise
If you still a little slow in keeping up with this guy, like me, it really helps to slow the video down a notch or two in the settings 😢
awesome info John, is this pretty much the same file location on macos and linux?
OSX location = /Library/Application Support/Google/Chrome/Profile/Login Data
Linux = /home/{user}/.config/google-chrome/Default/Login Data
Encryption key stored differently as well.
That is unreal 😮
There are utilities for 'whatever web-browser you are using'? What about Safari on macOS; I was under the impression that it uses the system keychain for password storage.
Most browsers also autofill the passwords in the field. It shows as black dots but u can inspect element and change type from "password" to "text" and it shows in plain text. You can probs make a script to scrape through websites and extract plaintext. If you have a specific website you are looking for then it is even easier.
Definitely. That's the method I personnally use when I forget my own passwords.
You can just go to settings and view the passwords.
@@sven5666 Yeah, but to me personnally the Developer tools method is just faster.
@@sven5666 For that you need to know the system pw usually, this way u don't even need that.
@@kryptos1411 sounds good, thanks :)
What about On-device encryption: On-device encryption applies to your passwords and passkeys only. Sync passphrase applies to all of the data that you sync to Google via Chrome. Or attaching a google account to the password manager, would this make a difference?
This is very useful information. My only suggestion: Slow down a bit while you are presenting 2:16
nice i gonna try it
in windows environments , the encryption keys is located in the "local state" file , that is a huge security risk , in the other hand , in macos environment ,the encryption key in located in the keychain App , so in order to get the encryption key , first you need to unlock the keechain app .
Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData
Yeah, totally true. However, the scenario assumes the attacker is running the script with same privileges as the victim. Most malware run with that privileges I suppose, but think it is important to mention.
More accurately, the script needs to run in the same security context as the target user (having local administrator privileges on the same computer is insufficient). Let's say you have/gain physical access to a user's computer, but you can't and/or don't want to sign on as them. Assuming Windows: maybe you don't know/have their Windows password and you don't want to change it to a known password. You boot the system with something like Hiren's and set a password on and enable the built-in administrator account, then boot the computer and sign on with the built-in administrator account. Even after tweaking the script to target the user's (not built-in administrator) Chrome, you will see a message something like, "(-2146893813, 'CryptUnprotectData', 'Key not valid for use in specified state.')
[ERR] Chrome secretkey cannot be found."
I have been watching your videos for quite a long time now and I really do appreciate what you offer, as am currently much of on the side of software development, I would really want to venture into cyber security career but much on a self taught basis, I was requesting if you can drop us a simple road map to learning and becoming one. Thanks
Up 🙏🍀
Awesome this is a super informative and helpful video. Is there a similar version for MS Edge passwords?
To decrypt Edge modify the python script, replace global constant:
CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE']))
CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Default\Login Data"%(os.environ['USERPROFILE']))
With Edge path:
EDGE_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE']))
EDGE_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE']))
and then change CHROME to EDGE in the rest of script where paths are being referenced.
I love your content and appreciate your work, tho 1/5 of the video being a sponsored segment is a bit harsh.
i remember back when i was a kid, playing around with dark comet. it had this built in and id use it on my mates (pretending i had "coded a program") and then use it to scrape their passwords and almost always they would have the same pass for everything so I'd login to their Minecraft accounts. we were 12-13 so it was a lot more innocent.
nice to actually no how to do it for real though rather than off the shelf!
What is the passwords are stored in google account ? the login sqlite db will be empty ?
Great video John but could you help me real quick? I tried following along but got the following errors when I initiated the final decryption step: “CryptUnprotectData”, “Key not valid for use in specified state” and “Chrome secretkey cannot be found” . Please help. Thanks
I have a question if we use metaspoit and get the password login file of chrome how can we decrypt them locally I couldn't find anything about it
How to do this one a userdata file from a user that is not the current user?
Спасибо тебе за твою работу!
"thank you for your work"? did i get that right without a translator? :o
@@kipchickensout yup
@@kipchickensout yes(da)
nice:)
This is really only an issue on one platform: Windows. Windows is the only mainstream OS to not provide per-application secure storage. As an example, on Windows it is impossible for your browser to prevent a random download from accessing all stored passwords/cookies. This is a primary reason account hijacking is popular on Windows but not on other platforms.
Linux has AppArmor/SELinux (though often unused), MacOS has keychain, iOS & Android has app-isolated storage by-default for every app, and ChromeOS uses the same-origin-policy.
“…Or, God forbid, Internet Explorer” 🤣🤣🤣
hi i have question can you plz answer ? chrome save my Gmail account but i forget my Gmail password now i want to look it up in autofill option but there is no Gmail password mention all other save passwords are available but there is no gmail password is showed what i suppose to do ?
Makes me wonder why they don't encrypt the storage with your account password and if you have a sync password salt it with that.
If I have access to the computer, i can just go into the password manager of the browser and look at the password in plain text. I dont see the point of this exercise.
The "pypiwin32" doesn't install in my macos. As I couldn't able to run this script. Any suggestions to recover it.
How do you secure your passwords ? ( actually not "comercial" because they support you ) :)
So what's the point for Chrome to encrypt it anyway since it's all like as if it just stored it in plaintext on the local machine?
Encrypting makes it slightly more difficult to steal the data rather than storing it directly in plaintext in a file.
I'm negativity surprised, so the cracking is portable! Once you snapshot those 2 or 3 files you can payload them to the remote without the need to access local resources. Astonished they do not have alayer of Syskey encryption in the chain.
Does this also apply to the gnome keyring? Because I don’t use Windoze as a desktop…. I don’t think anything is secure on that platform anyway.
I know that the gnome keyring gets unlocked on during login, however, that is different than being available from the file system…
software that wants access to the keyring always has to ask for permission from the user first (at least the first time) even if it is unlocked afaik
Does it actually work if you just grab the files, or does it use DPAPI so it can only be decrypted if the user is currently logged on?
It can be downloaded and than also decrypted on your own machine. Very easily! Do avoid it put a master password - that do a little bit harder to decrypt all your saved passwords. The bad person need first the master password - bruteforce but If you choose a very long Password for that, than it takes years to bruteforce it. But Choose your own password managment system what do you like. 100% Safty is not given in the IT-World.
Yes that user needs to be currently logged on.
Thanks. Combined with discord hooks system, you can do some social engineering.
So getting down into the weeds a bit, how is this script able to just work out of the box? Is the key the same across all installations of Chrome such that the script can just reverse the ciphertext given the IV used?
Would love to hear from someone who might know!
i mean it can just read out the key right? but the IV as well?
no every encryption key is different. the script reads the local_state file in chrome directory and extracts the encryption_key, then reads the login.sqlite data to extract the ciphertext and the IV that is all that is required to decrypt passwords.
Same technique works for credit cards as well.
What if your PC explodes or something? You will probabaly say that you can recover your passwords from another PC, but then you need a password for that, that will access all your passwords, so what's the point?
Odd this stuff doesn't appear in more malware payloads. Maybe grabbing session sso cookies is just so much easier cross-platform?
i agree
what do you mean? I think found malware that grabbed chrome passwords
"Here ya go third party, manage my password for me". Asinine.
Anyone know what it means to get this error message in command?
‘utf-8’ codec can’t decode byte 0xf6 in position 1: invalid start byte
[ERR] Unable to decrypt, Chrome version
8:51 Same for me, the exact same- URL, User Name there but Password is blank. It also shows
'utf-8' codec can't decode byte 0xf4 in position 0: invalid continuation byte
[ERR] Unable to decrypt, Chrome version
If i accidentally deleted one chrome account , should i see it throught this method ?
i want from linux but can do this?
good watching we undestand..
Use a passphrase to double encrypt the passwords. Simple thing
How did the chrome decrypter know where to look to decrypt your passwords, did it just "know" to go straight to your locally saved ones or did you direct it there somehow
Default path defined in script:
CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE']))
CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data"%(os.environ['USERPROFILE']))
If you need a custom path you can modify it.
i used this video well
Would changing the install location make any difference?
I think no matter where you install the browser, that these extra files are always stored in that directory 🤔 and if you changed it they might just scan the whole file system for it
I use Nirsoft WebBrowserPassView I think it does the same job.
Is it possible to decrypt browser passwords that are locked by a master password?
How does master password this work?
@John Hammond So i was running a few decryption tools and found that Firefox can't be cracked if there's a master password active.
Have you seen any news about a decryption for master passwords?
Edit: Fixed typo.
If a user has master password set your only option is to brute force the password.
@@webofchaos2684That's what i was thinking but he said it's possible to crack Firefox.
Maybe he just meant the vanilla version with no master pass.
Think he may be referring to Firefox without a master password set. All passwords and encryption key are stored in the key3.db file which is decrypt-able when no password is applied.
Does this work only for chorme or all chromium browsers, apart from that it may be a different location?
script works for all Chromium browsers on windows Chrome,Microsoft Edge,Brave,Opera just need to change browser directory
How can we access \ get the code shown in the video ? any help anyone ?
What about on Linux. And Firefox or edge are the on same of decryption
Almost certainly yes. No reason they wouldnt be and it makes sense to use the same encryption standard besides anything else it would take unnecessary dev time to impliment a separate encryption standard for linux
Edit: that answer was talking about chrome on linux but yeah edge and firefox use aes
On linux the key used to encrypt passwords is typically stored in a wallet, like kwallet or gnome keyring. On my system for example, it's stored in kwallet, which is itself encrypted with my GPG key. So I have to type in the password to my GPG key after I log in.
Chromium Browsers in Linux are just as bad uses default password 'peanuts' and salt 'saltysalt' you can just build a AES decrypter in python.
@@webofchaos2684 not true: if either gnome-keyring or kwallet are running, Chromium will generate a random 16-byte key and store it in the keyring.
@@e995a1ad you can bypass the key ring by using the default password and salt hashing it with AES-128-cbc method.
So the python script grabbed the key from the Local state file to decrypt the db?
python script extracts the encryption_key from Local state json file to decrypt the ciphertext stored in Login Data database. sqlite db is not encrypted.
Do you know what version of chrome this works for? Didn’t work for me it did pull all sites and usernames though
Works for browser versions 80+
where do i find SQLITE to read data file from windows?
I recently asked ChatGPT to do so using C# to read the sqlite file but sadly didn't try it out to confirm how efficient the solution was ( i sort of think the passwords weren't encrypted in that file )
Python makes it easier
@@kodiererg sure it does
I wonder if there is a similar approach for stored credit cards in the web browser.
Credit cards are stored in the file Web Data
@@webofchaos2684 Thx for the answer.
Hey man, i am in a pickle if you could assist i would be forever in your debt.
I have my login data file from my other SSD.
I created a new windows install on a m.2 and now cant run the decrypt on my original drive with the passwords on it. however i am able to optain the Chrome files. Any ideas. again any assistance would be so dank.
So what happens when passbolt gets compromised? Didn't this happen to last pass? I think I will take my chances with Chrome password manager..
Also if someone has access to your local FS, you have bigger problems...
He JUST showed what a bad idea that is.
@@jdspecht682 Well... Lets say someone broke into your house, and ate your cake from the refrigerator(Chrome passwords). Would you be worried about that cake or that someone broke into your house? I think simmilar thing happens to storing passowords in browser's password managers. If attacker can access those files(chrome's), your machine is already compromised. I believe browsers password managers are not that bad after all :)
(Physical) access == always game over. In the past I’ve written code to extract secure cookies from
Chrome as well. Once you have full access, anything is possible.
which means any malicious programs you run can access it. Tip: dont run games on your main account or even your main computer.
Hello can you pls take it slow, all i want to know is can i still access a password mail which i enter on my chrome
Does the complexity the password matter? Say like you use Passbolt to generate a password, and its 26 characters long with letters, numbers, symbols; etc. Will the script still be able to break the key?
Password length does not matter. Character length can be 300 characters long. encryption key is stored locally so decrypting passwords and other information can always be done.
@@webofchaos2684 Having an encryption key is not the same as having a hash, right? I forgot the password to one of my rar file. I was wondering if I could get the hash is it possible to break that to recover the password.
@@DayzGone no they are not the same a hash is an encrypted output of the password. If you have a hash of the password of the rar file it's possible to bruteforce the hash to get the password assuming the length is not too long.
Google could fix this problem if they wanted to by requiring the user to enter a master password or perhaps login to thier Google Account after opening the browser once per OS startup that way the decryption key could be stored in memory and not on the drive. Firefox has been doing it this way for a very long time and it's more secure, but Google probably doesn't want to "inconvenience" it's users. It should still be option for people who need more security though
what if you don't have the internet and you want to the password of the service provider for login to renew the plan? Also, if someone has access to your PC, they can do anything.
"stored in memory" is not safe either. It needs to be encrypted in memory and even in cpu cache/registers.
Im actually shocked that it was rhat easy. Isnt google basically saying give us all your passwords si we can basically leave them lying sround on disk? Is there nothing else that would slow an attacker down?
I don't think there is a better solution. They can't put the encryption key on their servers. Also, secure your computer, don't download things from unknown emails or sources. Don't disable the UAC.
one thing people never think about when trying to live more securely, it's just how many accounts do you *need*
if you don't use a service, delete it. if you reduce your attack vector then there's less to hack. I deleted over 100 accounts recently and I feel like a huge weight is lifted off of my shoulders.
also 2fa literally everything if possible. if you can't use an auth app with the site, at least use a number or email verification, yes you can sim swap, but it's better than nothing.
used an auth app before lol
screen of phone broke and I'd have to repair it to log in again
@@kipchickensout that's why you use an auth app that has a backup feature
@@JessicaFEREM i guess google authenticator doesn't have that then 💀
@@kipchickensout I use aegis
@@JessicaFEREM I'll take a look at it, thanks
If you have access to the local system you can own it anyway - keylogging, run applications or malware etc. And in the last 6 months at least 1 (maybe 2?) password manager/s has/have been hacked so be careful where you save your password manager data - and the access to it.
Keylogger and other malware can be caught by even the most basic of AVs these days. While a simple program that only does file read operations on disk might not be flagged by AV.
@@schizo5189 Keyloggers can be hardware devices that are not detectable by AVs. AVs have a very bad record of finding zero day exploits. Physical security is important. But if you have access and can get admin rights a keylogger can be installed to be ignored or undetectable by AVs. If AVs were the total security solution then there would be no encrypted drives or stolen data - which is happening every day.
Is there any way I can see my gmail password on mac? I don't remember the password and it is not saved in password manager. Please help 🙏🥺🥺
Mr hommand, where should I get started to learn the hacking, which books would you prefer?
i never save passwords on browsers. i use a encrypted password manager when i need my passwords.
Would I be wrong to assume that copying the whole google chrome folder into a Linux machine and running the script would get the same results? Don’t love running scripts that I don’t know everything it’s doing. Wish I knew everything ha
python script would fail as module win32crypt only works on Windows.
@@webofchaos2684 thank you! I think I ended up getting a windows vm for this.