12

I have Chrome 33+ in Ubuntu and I see that the cookies are encrypted in a BLOB structure:

CREATE TABLE cookies (creation_utc INTEGER NOT NULL UNIQUE PRIMARY KEY,host_key TEXT NOT NULL,name TEXT NOT NULL,value TEXT NOT NULL,path TEXT NOT NULL,expires_utc INTEGER NOT NULL,secure INTEGER NOT NULL,httponly INTEGER NOT NULL,last_access_utc INTEGER NOT NULL, has_expires INTEGER NOT NULL DEFAULT 1, persistent INTEGER NOT NULL DEFAULT 1,priority INTEGER NOT NULL DEFAULT 1,encrypted_value BLOB DEFAULT '');

I would like to write a python script to decrypt the cookie. I've seen that there is Cookie issue with Chrome 33 Beta but relies in CryptUnprotectData that it's a Windows API.

First of all I would like to know how are the cookies encrypted. I've read 3DES and AES but I don't find a trusty source to get the info.

I will write the code to do the necessary encryption and decryption if I have info about how to do it.

Thank you

Community
  • 1
  • 1
Alberto
  • 701
  • 4
  • 9
  • 25
  • [sqlite_persistent_cookie_store.cc#1003](https://chromium.googlesource.com/chromium/chromium/+/0b5fa91b3f7c94427c253e0ddcc047836d1d2c0d/content/browser/net/sqlite_persistent_cookie_store.cc#1003) , [sqlite_persistent_cookie_store_unittest.cc](https://src.chromium.org/viewvc/chrome/trunk/src/content/browser/net/sqlite_persistent_cookie_store_unittest.cc?view=log#rev241004) – Omid Raha Apr 09 '14 at 21:41
  • 1
    Thanks @OmidRaha. According to that the C++ Function `DecryptString` is the one who takes care of the decryption of the BLOB. I'm going to find how it works ;) – Alberto Apr 09 '14 at 22:14
  • 1
    Any progress here? Running into the same problem – mcpeterson May 10 '14 at 18:02

3 Answers3

7

I've posted an example Python script here for decoding the encrypted cookies in either OSX or Linux.

Community
  • 1
  • 1
n8henrie
  • 2,737
  • 3
  • 29
  • 45
6

I have been working on it too. Until now I have found that Chrome(Windows) uses CryptProtectData function to encrypt it's cookie's values. The same function it has been using to encrypt saved passwords in Login Data file. CryptProtectData uses the user account information and password of the logged in windows user to encrypt data. To decrypt it we have to use CryptUnProtectData function with the same user account logged in.

Here is a snippet to decrypt Login Data https://gist.github.com/jordan-wright/5770442

Now regarding Linux I have read here: http://www.linkedin.com/groups/Google-Chrome-encrypt-Stored-Cookies-36874.S.5826955428000456708

on other systems it seems to obfuscate passwords with the salt "saltysalt" and the password "peanuts"

evandrix
  • 6,041
  • 4
  • 27
  • 38
tabahi
  • 71
  • 5
2

The comments are a bit confusing so just to clarify, this is the chromium source in os_crypt_win.cc so you can see it's just putting the string into a blob and running CryptUnprotectData()

bool OSCrypt::DecryptString(const std::string& ciphertext,
                            std::string* plaintext) {
  DATA_BLOB input;
  input.pbData = const_cast<BYTE*>(
      reinterpret_cast<const BYTE*>(ciphertext.data()));
  input.cbData = static_cast<DWORD>(ciphertext.length());

  DATA_BLOB output;
  BOOL result = CryptUnprotectData(&input, NULL, NULL, NULL, NULL,
                                   0, &output);
  if (!result)
    return false;

  plaintext->assign(reinterpret_cast<char*>(output.pbData), output.cbData);
  LocalFree(output.pbData);
  return true;
}
Daniel Szanto
  • 89
  • 1
  • 9