How To Extract Plaintext Google Chrome Passwords
HTML-код
- Опубликовано: 21 авг 2024
- j-h.io/passbolt || Use a password manager to keep all your credentials secure -- my code JOHN-HAMMOND will save 20% off!! j-h.io/passbolt
AND HEY COME PLAY NAHAMCON CTF THIS WEEKEND ctf.nahamcon.com/
🔥 RUclips ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
![Hack System With Keylogger | [ Hindi ]](http://i.ytimg.com/vi/DJu9qpvNKQQ/mqdefault.jpg)
Browsers: don't worry, we encrypt all of your passwords to keep them safe!
Also browsers: we store the encryption key right beside your passwords!
i mean no matter where you store it people can just find it and look for it inside of their script
@@Luna5829 Encryption keys be generated from text, so in reality the can store locally with a password as the encryption key. Also when the browser is online it can use the browsers company servers, so no need to use a local copy in that scenario anyway.
For your convenience of course
@@retzerR Can you imagine how ticked someone would be if the internet went down and their ISP asked them to log in to their router but the browser stored the encryption keys exclusively in the cloud? I don't think any do that.
@@jmr Good point, but they can also be stored locally, just with a password used to generate the encryption key, which is never stored. At least then the password will have to be brute forced, or social engineered
Moral of the story don't save passwords in the browser, awesome video John love your content.
Passbolt (and any other password manager) employs the similar mechanisms for storing and sharing passwords as your browser password manager, it just has a robust feature set for sharing the password with others. Don't get lazy and believe any password manager is a golden bullet.
Passwords are stored using a cipher, which will take a long time to break if you were to brute force it, but the key to the cipher needs to be kept on your local machine in order to access them.
The best way to protect yourself is to use multiple layers of authentication. 2FA authenticator applications, NFC tags, biometrics. Separate storage or data mediums that can have a hash created, so only the medium itself is a way to authenticate. Employ good practice and having multiple layers of security is the best way to keep you and your data protected.
I commented before your last paragraph then realised it said the same thing 😂
...and this is WHY scam-baiters are constantly telling ppl to NOT store passwords in the browser! Awesome vid John!
This is why you use hardware encryption keys, or other 2fa for everything, including browser based password systems
@@JeremyPatMartin what do you recommend? I want to have a hardware kinda thing to store my passwords , thank you
John, you explain in a way that is very understandable something so many people dont have the time/skills to do.I enjoy not only watching your vodeos but also just listening as you explain thoroughly i can almost visualise what you are doing.I hope you get to where you deserve to be pal !!!
Almost any password vault is vulnerable to local attacks. Unless you're typing something in when you go to log into a website, there's a guaranteed way to retrieve that password if you have local access. Even if you have to go to the website and wait for the tool to fill in the password field, you can get it once the password field is filled out in the browser with a trivial console command.
To be honest on most sites you can just copy paste the password from the password field of the website into any text field.
@@UNagano589 🤣😂😂
A easier solution is to go to the website of the stored password, let it auto fill it, and change the HTML to show the starred contents.
I haven't seen this work in quite a long time.
@@parkerlreedI have been successfully using this method for 10 years on chrome, last time was yesterday
@@parkerlreed it does still work i think
yep, it still does work...
What this video can help with is when can pull someone password files to your pc( using powershell script, for example) or when you get a shell access only
Internet explorer crying in the corner
The weakness looks a LOT like windows instead of chrome. Don't save your chrome passwords locally on a windows machine
where it belongs. in the corner. an eternity in the time-out corner.
😢
Imagine using IE 😂
@_GhostMiner Edge is better than chrome, has been for a while.
Careful, I remember there was some algorithm that can decrypt pixelated censor and it is really good at it, hope you changed your other user password after this
You're right in some contexts, but it needs more precision; you can undo many blurring effects and you can undo some pixelated censors.
The vulnerable pixelated censors are the ones using many pixels to censor the content, king of like a pixelated "low res blur effect", so to speak. In this context, the one John is using uses whole squares, which does not seem to leak info from under, so I'd reckon it is not vulnerable to that attack vector.
I personally would censor using a plain color bar, as it is never affected by that attack.
Wasn’t it also just brute-forcing instead of decrypting? Think of the pixelated blur as something like a one-way hash function: blurring the same text results in the same pixel values, but reversing is hard.
@@blablubb1234 imagine a two-way hash function
Depix, for example, if I remember correctly. But yeah, unlikely tp work here.
that only works with shitty pixelated censoring.
not just saved passwords, we can easily access logged in sessions using cookies. if u get system u get everything
So I have to leave the comment to let you know that you've helped so much. True could have happened with any video but just happened to hit yours first. My uncle passed away a week or so ago and he had a lot of cherished memories stored in his phone and laptop, I've learned to get through the windows password the pash couple of days probably through the least direct wya but this helped me to guess what his phone password was and get the remaining memories. Thank you for making the video and helping me recover the cherished memories.
I learned this a long time ago. You can very easily make a vba macro that can email you all of someone's Chrome passwords in clear text.
How sir ?
Most browsers also autofill the passwords in the field. It shows as black dots but u can inspect element and change type from "password" to "text" and it shows in plain text. You can probs make a script to scrape through websites and extract plaintext. If you have a specific website you are looking for then it is even easier.
Definitely. That's the method I personnally use when I forget my own passwords.
You can just go to settings and view the passwords.
@@sven5666 Yeah, but to me personnally the Developer tools method is just faster.
@@sven5666 For that you need to know the system pw usually, this way u don't even need that.
@@kryptos1411 sounds good, thanks :)
I was actually intrigued when i saw passbolt sponsor this video, cause i switched to them from lastpass about 3 months ago..honestly yes, best pw manager i can say
And thats why I dont save passwords anywhere. I have a password algorithm in my head that creates a random string pass, upper/lower case, numbers, etc for each site. Don't need to remember them that way. If it ends up on a hacked password dump, it won't work on any other site and looks like a long random string.
This is really only an issue on one platform: Windows. Windows is the only mainstream OS to not provide per-application secure storage. As an example, on Windows it is impossible for your browser to prevent a random download from accessing all stored passwords/cookies. This is a primary reason account hijacking is popular on Windows but not on other platforms.
Linux has AppArmor/SELinux (though often unused), MacOS has keychain, iOS & Android has app-isolated storage by-default for every app, and ChromeOS uses the same-origin-policy.
Always informative
Yeah, totally true. However, the scenario assumes the attacker is running the script with same privileges as the victim. Most malware run with that privileges I suppose, but think it is important to mention.
More accurately, the script needs to run in the same security context as the target user (having local administrator privileges on the same computer is insufficient). Let's say you have/gain physical access to a user's computer, but you can't and/or don't want to sign on as them. Assuming Windows: maybe you don't know/have their Windows password and you don't want to change it to a known password. You boot the system with something like Hiren's and set a password on and enable the built-in administrator account, then boot the computer and sign on with the built-in administrator account. Even after tweaking the script to target the user's (not built-in administrator) Chrome, you will see a message something like, "(-2146893813, 'CryptUnprotectData', 'Key not valid for use in specified state.')
[ERR] Chrome secretkey cannot be found."
in windows environments , the encryption keys is located in the "local state" file , that is a huge security risk , in the other hand , in macos environment ,the encryption key in located in the keychain App , so in order to get the encryption key , first you need to unlock the keechain app .
Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData
Ur awesome, I'm so happy I found a video of something so hard to learn, I had already given up thinking that I wouldn't be able to find information on how to decrypt my browser passwords, thanks!
I have been watching your videos for quite a long time now and I really do appreciate what you offer, as am currently much of on the side of software development, I would really want to venture into cyber security career but much on a self taught basis, I was requesting if you can drop us a simple road map to learning and becoming one. Thanks
Up 🙏🍀
I love your content and appreciate your work, tho 1/5 of the video being a sponsored segment is a bit harsh.
Fun fact your card details are also stored in these databases, albeit without the cvv code. An attacker can also grab your auto fill data such as addresses,ssn,phone numbers etc
If you still a little slow in keeping up with this guy, like me, it really helps to slow the video down a notch or two in the settings 😢
I'd love to see some timelines on your videos John! :)
Why am I only now hearing about Passbolt? It sounds like something everyone I talk to would talk about.
don't use it
@@supyrow any reason why?
This is why it's important to secure your OS login! For the convenience that the browser's password manager offers, like those on your phone, you have to ensure your OS login is secure and to not leave it unlocked. Treat it like you would your phone.
Of course, this assumes other users of the device aren't admins. And I do think Chrome should find a way to avoid storing the cryptographic key in the cloud and off the local device, even if that requires re-authenticating with Google every time you launch your browser - it should at least be an option.
That will work up to a point; with a Live OS, anything unencrypted on the disk can be read. BitLocker / Password protected browsers can help though.
Yes, drive must be encrypted and a strong login.
“…Or, God forbid, Internet Explorer” 🤣🤣🤣
I've yet to see a "password manager" that I feel entirely comfortable with. Ultimately your passwords have to be stored on something physical. Even if in encrypted form, they're only as good as the encryption key/password used to encrypt them. And how do you store that? You're down to memory versus sticky notes, and master passwords are a vulnerability in themselves. Thoughts?
string multiple words together with extras = easy for human, difficult for gpu to brute force. random characters= difficult for human, very easy for gpu brute force
i use 'pass' from passwordstore
@@supyrow Yeah and the very nature of a master/backup password is that you may not need to use it for years. Now, what was that phrase again? This is not hypothetical. I recently encountered a stash of old engineering data from 10 years ago. Could I remember the pass phrase? Nope? Fortunately it wasn't a huge loss.
@@saumyacow4435 well, with gpg, yeah there is a passphrase to unlock, or you can use the non-public file to unlock as well.
dunno man. i've never forgotten my master passphrase, i change it annually and use it often enough to not forget it,. it's has become quite common recently to use multiple word chains
I'm negativity surprised, so the cracking is portable! Once you snapshot those 2 or 3 files you can payload them to the remote without the need to access local resources. Astonished they do not have alayer of Syskey encryption in the chain.
This is very useful information. My only suggestion: Slow down a bit while you are presenting 2:16
Awesome content and very informative! 🙌
I really appreciate your content it is really helpful. And is there any way of decrypting those chrome passwords on another machine?
Your sponsor is awesome 🤩
Awesome this is a super informative and helpful video. Is there a similar version for MS Edge passwords?
To decrypt Edge modify the python script, replace global constant:
CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE']))
CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Default\Login Data"%(os.environ['USERPROFILE']))
With Edge path:
EDGE_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE']))
EDGE_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE']))
and then change CHROME to EDGE in the rest of script where paths are being referenced.
I will gladly follow along, thanks for the invitation, John!
Anyone know what it means to get this error message in command?
‘utf-8’ codec can’t decode byte 0xf6 in position 1: invalid start byte
[ERR] Unable to decrypt, Chrome version
8:51 Same for me, the exact same- URL, User Name there but Password is blank. It also shows
'utf-8' codec can't decode byte 0xf4 in position 0: invalid continuation byte
[ERR] Unable to decrypt, Chrome version
"Here ya go third party, manage my password for me". Asinine.
0:06 LMFAO 😂😂😂
ur funny 😅
Odd this stuff doesn't appear in more malware payloads. Maybe grabbing session sso cookies is just so much easier cross-platform?
i agree
what do you mean? I think found malware that grabbed chrome passwords
(Physical) access == always game over. In the past I’ve written code to extract secure cookies from
Chrome as well. Once you have full access, anything is possible.
which means any malicious programs you run can access it. Tip: dont run games on your main account or even your main computer.
i did the exact same thing today but for firefox browser. In a real life case when you use a reverse shell to access the machine you have to compress the folder with the tar command then download the zip file.
If I have access to the computer, i can just go into the password manager of the browser and look at the password in plain text. I dont see the point of this exercise.
If you have access to the local system you can own it anyway - keylogging, run applications or malware etc. And in the last 6 months at least 1 (maybe 2?) password manager/s has/have been hacked so be careful where you save your password manager data - and the access to it.
Keylogger and other malware can be caught by even the most basic of AVs these days. While a simple program that only does file read operations on disk might not be flagged by AV.
@@schizo5189 Keyloggers can be hardware devices that are not detectable by AVs. AVs have a very bad record of finding zero day exploits. Physical security is important. But if you have access and can get admin rights a keylogger can be installed to be ignored or undetectable by AVs. If AVs were the total security solution then there would be no encrypted drives or stolen data - which is happening every day.
I cannot imagine how this should work on my Linux (Ubuntu server/openbox/gnome-keyring) machine. The sqlite db 'Login Data' is locked when the browser is open and the passwords encrypted otherwise, of course. There is no way to get to the passwords other than being logged in as me.
Nice John :D
Use a passphrase to double encrypt the passwords. Simple thing
Thank you JH 🙏
How to do this one a userdata file from a user that is not the current user?
So what's the point for Chrome to encrypt it anyway since it's all like as if it just stored it in plaintext on the local machine?
Encrypting makes it slightly more difficult to steal the data rather than storing it directly in plaintext in a file.
Does it actually work if you just grab the files, or does it use DPAPI so it can only be decrypted if the user is currently logged on?
It can be downloaded and than also decrypted on your own machine. Very easily! Do avoid it put a master password - that do a little bit harder to decrypt all your saved passwords. The bad person need first the master password - bruteforce but If you choose a very long Password for that, than it takes years to bruteforce it. But Choose your own password managment system what do you like. 100% Safty is not given in the IT-World.
Yes that user needs to be currently logged on.
is the masterpassword on firefox an easiest solution ? doesn't use the masterpw to encrypt ?
thank you in advise
Trying it out on my own pc but command prompt keeps getting a error saying it can't install win32crypt??
OMG. It worked. Thanks a lot. U r a genius. May be you can explain a bit about the data collected from files. Like one was a base64 encoded crypto key and what was the other one with sqlite?
i remember back when i was a kid, playing around with dark comet. it had this built in and id use it on my mates (pretending i had "coded a program") and then use it to scrape their passwords and almost always they would have the same pass for everything so I'd login to their Minecraft accounts. we were 12-13 so it was a lot more innocent.
nice to actually no how to do it for real though rather than off the shelf!
awesome info John, is this pretty much the same file location on macos and linux?
OSX location = /Library/Application Support/Google/Chrome/Profile/Login Data
Linux = /home/{user}/.config/google-chrome/Default/Login Data
Encryption key stored differently as well.
Amazing video🎉
Thanks for this excellent video. After seen it, I wonder how do you know the location and lenght of the initialization vector [3:15]. I did not get where do you obtain it from. Also, how to you know the lenght of the encryted password itself [15:-16]. That was also unclear to me. Once you get those, the rest of the work seems to be pretty straightforward... Thanks again!
What is the passwords are stored in google account ? the login sqlite db will be empty ?
Thanks dude!
Makes me wonder why they don't encrypt the storage with your account password and if you have a sync password salt it with that.
I don't think there is a better solution. They can't put the encryption key on their servers. Also, secure your computer, don't download things from unknown emails or sources. Don't disable the UAC.
I was looking for this thing.. thanks John
What detection rules would you recommend for such cases ? Any specific eventid or something ?
I thought this was pssible. Thanks John.
Nice and thanks for sharing. What is the impact / possibility if the encryption key of the local password storage is "protected" by a master password (Let's assume it is complex or is a long-assed pass phrase) would that be a mitigation for local storage attacks?
5:46 mini heart attack
*laughs in inspect element
0:00 Ummmm.... No, because I don't let browsers do that. And the reason I don't is because I knew this was a possibility.
There are utilities for 'whatever web-browser you are using'? What about Safari on macOS; I was under the impression that it uses the system keychain for password storage.
That is unreal 😮
Please demonstrate one for Microsoft edge too
To use script on Edge change Global constant to:
# Reads from Microsoft Edge Directory
CHROME_PATH_LOCAL_STATE= os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE']))
CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE']))
Would changing the install location make any difference?
I think no matter where you install the browser, that these extra files are always stored in that directory 🤔 and if you changed it they might just scan the whole file system for it
one thing people never think about when trying to live more securely, it's just how many accounts do you *need*
if you don't use a service, delete it. if you reduce your attack vector then there's less to hack. I deleted over 100 accounts recently and I feel like a huge weight is lifted off of my shoulders.
also 2fa literally everything if possible. if you can't use an auth app with the site, at least use a number or email verification, yes you can sim swap, but it's better than nothing.
used an auth app before lol
screen of phone broke and I'd have to repair it to log in again
@@kipchickensout that's why you use an auth app that has a backup feature
@@JessicaFEREM i guess google authenticator doesn't have that then 💀
@@kipchickensout I use aegis
@@JessicaFEREM I'll take a look at it, thanks
WTF chrome?
I designed a system, without mention what it does, it store database information in file (port,ip,name,username and password), I encrypted this file in aes, the key i used for enc is derived from the system admin password
Admin password--->md5(16 bytes)------>sha256(32 bytes)
The reason why i didnot use sha256 output without md5 is i already use it to store the admin password in shadow file
I know it is a security threat that the whole thing rely on 16 byte
Also i know there are algorithims for key derevation better than the one i used
But the whole thing is just for graduation project
So with these password managers, you now have a single point of failure? You still need to remember *something*. And if you forget / lose that part, then you are really screwed, aren't you?
I have deployed my own bitwarden on my local linux pc server after years using Lastpass which I don't trust anymore. Saving passwords locally in chrome and even in firefox is the worst possible approach.
What about On-device encryption: On-device encryption applies to your passwords and passkeys only. Sync passphrase applies to all of the data that you sync to Google via Chrome. Or attaching a google account to the password manager, would this make a difference?
Спасибо тебе за твою работу!
"thank you for your work"? did i get that right without a translator? :o
@@kipchickensout yup
@@kipchickensout yes(da)
nice:)
Well this makes me uncomfortable
Hey, when i tried to reproduce it the output shows no password and nothing at all it just shows the path to login data file
I feel sorry for ppl that do not use password managers.
I feel sorry for ppl that use password managers and think they aren't still vulnerable.
A customer asks: Is there a way to use the Internet sensibly as a normal person? We: Nope. 🤣
What if your PC explodes or something? You will probabaly say that you can recover your passwords from another PC, but then you need a password for that, that will access all your passwords, so what's the point?
nice i gonna try it
I wonder if there is a similar approach for stored credit cards in the web browser.
Credit cards are stored in the file Web Data
@@webofchaos2684 Thx for the answer.
I recently asked ChatGPT to do so using C# to read the sqlite file but sadly didn't try it out to confirm how efficient the solution was ( i sort of think the passwords weren't encrypted in that file )
Python makes it easier
@@kodiererg sure it does
Google could fix this problem if they wanted to by requiring the user to enter a master password or perhaps login to thier Google Account after opening the browser once per OS startup that way the decryption key could be stored in memory and not on the drive. Firefox has been doing it this way for a very long time and it's more secure, but Google probably doesn't want to "inconvenience" it's users. It should still be option for people who need more security though
what if you don't have the internet and you want to the password of the service provider for login to renew the plan? Also, if someone has access to your PC, they can do anything.
"stored in memory" is not safe either. It needs to be encrypted in memory and even in cpu cache/registers.
Great video John but could you help me real quick? I tried following along but got the following errors when I initiated the final decryption step: “CryptUnprotectData”, “Key not valid for use in specified state” and “Chrome secretkey cannot be found” . Please help. Thanks
So what happens when passbolt gets compromised? Didn't this happen to last pass? I think I will take my chances with Chrome password manager..
Also if someone has access to your local FS, you have bigger problems...
He JUST showed what a bad idea that is.
@@jdspecht682 Well... Lets say someone broke into your house, and ate your cake from the refrigerator(Chrome passwords). Would you be worried about that cake or that someone broke into your house? I think simmilar thing happens to storing passowords in browser's password managers. If attacker can access those files(chrome's), your machine is already compromised. I believe browsers password managers are not that bad after all :)
Winpeas can also pull browsers password
when my Google chrome updated… I lost a WHOLE bunch of passwords. I have no idea how or why, I guess they did not sync properly ?? Is there any way I can find where they were saved locally ?? Or have they been overwritten 😭😭 (I am a mac user)
Thanks. Combined with discord hooks system, you can do some social engineering.
Is there a way to make Google stop asking me if I want to save the password? go to site - login - google asks if I want to save - I answer Never. Next time - same site - get asked again. What part of never is google not understanding?
Also - "press the I believe button". LOL I have not heard that phrase since nuclear power training school in the 80s. :)
What about on Linux. And Firefox or edge are the on same of decryption
Almost certainly yes. No reason they wouldnt be and it makes sense to use the same encryption standard besides anything else it would take unnecessary dev time to impliment a separate encryption standard for linux
Edit: that answer was talking about chrome on linux but yeah edge and firefox use aes
On linux the key used to encrypt passwords is typically stored in a wallet, like kwallet or gnome keyring. On my system for example, it's stored in kwallet, which is itself encrypted with my GPG key. So I have to type in the password to my GPG key after I log in.
Chromium Browsers in Linux are just as bad uses default password 'peanuts' and salt 'saltysalt' you can just build a AES decrypter in python.
@@webofchaos2684 not true: if either gnome-keyring or kwallet are running, Chromium will generate a random 16-byte key and store it in the keyring.
@@e995a1ad you can bypass the key ring by using the default password and salt hashing it with AES-128-cbc method.
I use Nirsoft WebBrowserPassView I think it does the same job.
Is it possible to decrypt browser passwords that are locked by a master password?
How does master password this work?
I tried to access Local State but right now there isn't crypt key on Fedora, I haven't tried on Windows yet
Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData
Don't trust any browser with your password. Fixed.
I lost my trust in browser password managers when I first gained root access to workstation terminals on an ldap network. Back then the passwords were still stored in plaintext for both firefox and chrome. Obviously some people would use workstations to access social media, or maybe their bank, and I definitely wouldn't have trusted everyone else with root with that level of access. On one hand I'm happy the barrier to entry is slightly higher, so someone like me who thought I was a Linux god because I knew a handful of tar command flags can't figure it out, on the other hand... still yikes.