Export Chrome Cookies

[Colduction]

Hi everyone! i have Two-Problems:

• I've used this code to decode and export cookies from Google Chrome application's "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Default\Cookie" file but i can't receive any data:

#include <CryptProtect.au3>
#include <SQLite.au3>
#include <SQLite.dll.au3>

Global Const $g_sLoc_Output = @ScriptDir & "\Cookies.txt"
If FileExists($g_sLoc_Output) Then
   FileDelete($g_sLoc_Output)
EndIf
$hFO_Output = FileOpen($g_sLoc_Output ,1)
If $hFO_Output <> -1 Then
   FileWrite($hFO_Output, Chrome())
   FileFlush($hFO_Output)
   FileClose($hFO_Output)
EndIf

Func Chrome()
   Local $q, $r, $sOutput, $sLoc_ChromeDB = EnvGet("localappdata") & "\Google\Chrome\User Data\Default\Cookies"
   If FileExists($sLoc_ChromeDB) = False Then Return ""
   _SQLite_Startup()
   If @error Then
      MsgBox(16, "SQLite Error", "SQLite3.dll Can't be Loaded! - " & $__g_hPrintCallback_SQLite & @CRLF & @CRLF & "Exiting application")
      Exit -1
   EndIf
   _SQLite_Open($sLoc_ChromeDB)
   _SQLite_Query(-1, 'SELECT host_key, name, value, encrypted_value FROM cookies', $q)
   While _SQLite_FetchData($q, $r) = 0
      $sOutput = $sOutput & r[0] & @CRLF & r[1]
   WEnd
   _SQLite_Close()
   _SQLite_Shutdown()
   Return $sOutput
EndFunc

• I've used this code too for decrypt my saved passwords and export from Google Chrome application's "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Default\Login Data" file but i can't get decrypted data:

  #include <CryptProtect.au3>
  #include <SQLite.au3>
  #include <SQLite.dll.au3>
  
  Global Const $g_sLoc_Output = @ScriptDir & "\Credentials.txt"
  If FileExists($g_sLoc_Output) Then
     FileDelete($g_sLoc_Output)
  EndIf
  $hFO_Output = FileOpen($g_sLoc_Output ,1)
  If $hFO_Output <> -1 Then
     FileWrite($hFO_Output, Chrome())
     FileFlush($hFO_Output)
     FileClose($hFO_Output)
  EndIf
  
  Func Chrome()
     Local $q, $r, $sOutput, $sLoc_ChromeDB = EnvGet("localappdata") & "\Google\Chrome\User Data\Default\Login Data"
     If FileExists($sLoc_ChromeDB) = False Then Return ""
     _SQLite_Startup()
     If @error Then
        MsgBox(16, "SQLite Error", "SQLite3.dll Can't be Loaded! - " & $__g_hPrintCallback_SQLite & @CRLF & @CRLF & "Exiting application / Zavolej Honzovi")
        Exit -1
     EndIf
     _SQLite_Open($sLoc_ChromeDB)
     _SQLite_Query(-1, "select * from logins;", $q)
     While _SQLite_FetchData($q, $r) = 0
        $sOutput = $sOutput & "======================| " & $r[7] & " |======================" & @CRLF & "Login URL: " & $r[0] & @CRLF & "Email/User: " & $r[3] & @CRLF & "Password: " & _CryptUnprotectData($r[5], "") & @CRLF & @CRLF
     WEnd
     _SQLite_Close()
     _SQLite_Shutdown()
     Return $sOutput
  EndFunc

  Thanks!

Edited March 7, 2020 by Ho3ein

[Nine]

That works fine for me :

#include <Constants.au3>
#include <SQLite.au3>

Opt ("MustDeclareVars", 1)

Local $sResult = Chrome ()
ConsoleWrite (@error & @CRLF)
MsgBox ($MB_SYSTEMMODAL,"",$sResult)

Func Chrome()
   Local $q, $r, $sOutput, $sLoc_ChromeDB = EnvGet("localappdata") & "\Google\Chrome\User Data\Default\Cookies"
   If Not FileExists($sLoc_ChromeDB) Then Return SetError (1, 0, "")
   _SQLite_Startup()
   If @error Then Return SetError (2, 0, "")
   _SQLite_Open($sLoc_ChromeDB)
   If @error Then Return SetError (3, 0, "")
   Local $aNames, $hQuery, $aRow
   _SQLite_Query(-1, "SELECT host_key, name, encrypted_value FROM cookies WHERE ROWID < 50", $hQuery)
   _SQLite_FetchNames ($hQuery, $aNames)
   Local $sOutput = StringFormat ("%-40s  %-40s", $aNames[0], $aNames[1]) & @TAB & $aNames[2] & @CRLF
   While _SQLite_FetchData($hQuery, $aRow) = $SQLITE_OK
      $sOutput &= StringFormat ("%-40s  %-40s", $aRow[0], $aRow[1]) & @CRLF & $aRow[2] & @CRLF
   WEnd
   _SQLite_Close()
   _SQLite_Shutdown()
   Return $sOutput
EndFunc

ps. value is useless for me as it is always equals to "".  Note also I only read rows under 50

[Colduction]

Hi @Nine. thanks for your coding, but "encrypted_value" value's are already encrypted. as i told, my 2nd problem is decrypting this values from my chrome Cookies & Login Data db then export them to tidy plain text file.

But thanks for your taking time for me

Edited March 7, 2020 by Ho3ein

[Nine]

You won't be able to decrypt it unless you know the key that was used.  And I highly doubt that Google will tell you that 

[Colduction]

  On 3/7/2020 at 9:15 PM, Nine said:

You won't be able to decrypt it unless you know the key that was used.

Expand  

I've tested some softwares that do this and actually worked fine for me.

It's not impossible.

[Nine]

 great protection Google put on there 

[Colduction]

  On 3/7/2020 at 9:21 PM, Nine said:

great protection

Expand  

It uses Windows API CryptProtect lib for crypt and decrypt data.

I've used this function in AutoIt too, but i did't get decrypted values.

Many freewares are built in this way, but i don't know how they work fine😕

https://gist.github.com/DakuTree/428e5b737306937628f2944fbfdc4ffc

Edited March 7, 2020 by Ho3ein

[Nine]

Anyway, if you got all those tools to decrypt everything you want, WHY asking for help in here ?

[Colduction]

  On 3/7/2020 at 11:18 PM, Nine said:

WHY asking for help in here ?

Expand  

I want to code with my language (AutoIt) and export customized data as what i want.
 

[Colduction]

Any idea? 🤫




I've just got that Chrome 80 (and higher versions) requires to have Master Key in C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Local State file and this file's encrypted_key value has been encrypted via CryptProtectData (DPAPI), then for decrypt Cookie value or Logins value must be use AES-256 (GCB) Algorithm.

https://xenarmor.com/how-to-recover-saved-passwords-google-chrome/

But i don't know how to use in AutoIt, i just have C++ code for this issue🙁

 

[Subz]

Please do not PM, I prefer to use the forum.  You already mentioned there are tools out there that can do this, but in your PM you said you only wanted to get 2 website passwords, most sites have a "Forgot Password" so they should be able to resend you the passwords, can't they?

Also in Google Chrome you should be able to retrieve your passwords or use a password recovery tool see https://www.isunshare.com/internet/recover-or-find-passwords-saved-on-chrome-browser.html so once you have them and you store them in password manager there should be no reason for a script, right?

"I think AutoIt Forum's members think that decrypting credentials of Google Chrome is illegal, but there is a lots of free decryption tools for do this job, i want to get my credentials and cookies as what i want."

You need to remember that while your intentions might be good, this is a public form and others may use any code on here for bad, which hurts the AutoIt community.

Stay safe.

[Colduction]

Hi @Subz, The reason of this, is only that i can't access to my E-mail to Reset Password, but i sure that one of those passwords can be correct for 2 sites: www.zalando.de and ebay.com

I've written all of these codes but my problem is how to decrypt via Master Key