8

While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following (as a non-admin):

cd "users/user/library/application support/google/chrome/default"
sqlite3 "Login Data"
sqlite3> .output chrome-passwords.txt
sqlite3> select origin_url, username_values, password_value from logins;

Even if I run as root and pull the passwords I get the same thing, what is causing this and how can I retrieve them correctly?

CertifcateJunky
  • 481
  • 1
  • 5
  • 13
  • It will be something very wrong if Chrome allow you to skim through the sqlite data and get the password in plaintext without some authentication API to decode the stuff. – mootmoot May 25 '18 at 15:01
  • @mootmoot This is true, however, they use to store their passwords in plaintext. Would the decryption key by chance be in my keychain? – CertifcateJunky May 25 '18 at 15:03
  • Good luck ;-) https://github.com/adnan-alhomssi/chrome-passwords – mootmoot May 25 '18 at 15:10
  • Seems there is already answer here. https://security.stackexchange.com/questions/40884/is-saving-passwords-in-chrome-as-safe-as-using-lastpass-if-you-leave-it-signed-i/40887#40887 – mootmoot May 25 '18 at 15:11
  • 1
    @mootmoot "It will be something very wrong if Chrome allow you to skim through the sqlite data and get the password in plaintext" Well, how should they protect locally stored passwords (without a master password model)? – Arminius May 25 '18 at 15:11
  • @Arminius you can read the github link I gave. – mootmoot May 25 '18 at 15:13
  • 1
    Not only is that measure platform-specific, but it also isn't much safer than storing the passwords in plain text straight away. – Arminius May 25 '18 at 15:17
  • @Arminius .. Well, I quit using chrome locally stored password for quite some time ;-) – mootmoot May 25 '18 at 15:31
  • @mootmoot the program you sent is specifically for Windows systems – CertifcateJunky May 25 '18 at 18:34
  • That's why I put it as comment, not an answer. Anyway : Try your luck here https://github.com/manwhoami/OSXChromeDecrypt – mootmoot May 25 '18 at 18:50
  • I figured out how to get them done actually – CertifcateJunky May 25 '18 at 21:50
  • @CertifcateJunky, it's OK to answer your own question. This will help other people. – Neil Smithline May 26 '18 at 01:35
  • @Arminius excellent point. And even a master password would only provide a slight delay if malware is running locally as the devs have argued: https://bugs.chromium.org/p/chromium/issues/detail?id=1397 – J.A.K. May 26 '18 at 19:02
  • @NeilSmithline I will, just don't have time at the moment – CertifcateJunky May 29 '18 at 18:45

1 Answers1

4

Alright I figured it out and said I would post an answer.

The reason that the passwords showed up like they did is because they are encrypted with a pbkdf2 key that is stored in a specific keychain location (usually having the name 'Chrome' in it). To find this key you can execute the command security find-generic-password -wa 'Chrome' as an administrator and it should pull the key for you.

Once you have the key, in order to decrypt the you would need to;

  • Generate the IV (python -c 'import sys;sys.stdout.write("20" * 16)'
  • Get the salt (110% chance it's saltysalt)
  • Encrypt the found key using pbkdf2_hmac grabbing the first 16 characters and hexlify the encrypted key (python -c 'import binascii;import hashlib;key=hashlib.pbkdf2_hmac("sha1","<KEY>",b"saltysalt",1003)[:16];print binascii.hexlify(key))
  • Base64 encode the encrypted password and remove the first three characters (python -c 'import base64;print base64.b64encode("ENCRYPTED_PASSWORD")[3:]')
  • Decrypt the encryption with the following command: openssl enc -base64 -d -aes-128-cbc -v <IV> '<HEX KEY>' -K '<BASE64 ENCODED PASSWORD>'.

Luckily for you, I created a simple python function to return the same thing:

import base64
import binascii
import subprocess
from hashlib import pbkdf2_hmac


def decrypt(encrypted, key):
    iv = ''.join(('20', ) * 16)
    key = pbkdf2_hmac('sha1', key, b'saltysalt', 1003)[:16]

    hex_key = binascii.hexlify(key)
    hex_enc_password = base64.b64encode(encrypted[3:])
    try:
        decrypted = subprocess.check_output(
            "openssl enc -base64 -d "
            "-aes-128-cbc -iv '{}' -K {} <<< "
            "{} 2>/dev/null".format(iv, hex_key, hex_enc_password),
            shell=True)
    except subprocess.CalledProcessError:
        decrypted = "n/a"

    return decrypted

Please note, in order for the to work successfully, you have to have the administrative credentials for the computer you're running this on.

CertifcateJunky
  • 481
  • 1
  • 5
  • 13