Java - How do I decrypt Chrome cookies?

Question

I am trying to extract cookies from Chrome browser. I have found this post Reading and Inserting Chrome Cookies Java It takes cookies from user browser. The problem is that it doesn't work. This part of code throws an exception:

System.setProperty("jna.predictable_field_order","true");
decryptedBytes = Crypt32Util.cryptUnprotectData(encryptedCookie.getEncryptedValue());

    com.sun.jna.platform.win32.Win32Exception: Недопустимые данные.
    at com.sun.jna.platform.win32.Crypt32Util.cryptUnprotectData(Crypt32Util.java:128)
    at com.sun.jna.platform.win32.Crypt32Util.cryptUnprotectData(Crypt32Util.java:103)
    at com.sun.jna.platform.win32.Crypt32Util.cryptUnprotectData(Crypt32Util.java:90)
    at CookieExtractor.CookieExtractor$ChromeBrowser.decrypt(CookieExtractor.java:486)
    at CookieExtractor.CookieExtractor$ChromeBrowser.processCookies(CookieExtractor.java:448)
    at CookieExtractor.CookieExtractor$Browser.getCookiesForDomain(CookieExtractor.java:256)
    at CookieExtractor.CookieExtractor.getCookie(CookieExtractor.java:50)
    at CookieExtractor.CookieExtractor.main(CookieExtractor.java:38)

I started to dig how could I decrypt Chrome cookie and found this jar http://jdpapi.sourceforge.net/ but it didn't work too because this jar could not work with 64 bit OS. So I am really confused of how I can decrypt cookie from Chrome.

Any help appriciated!

Answer 1

As of Chrome v80.0, cookies are encrypted with AES GCM, see here. The key is encrypted with DPAPI. The following assumes a Windows 7/8/10 OS.

First, the key must be read from the Local State JSON file and decrypted using DPAPI. A possible Java implementation is:

import java.util.Arrays;
import java.util.Base64;
import java.io.FileReader;
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import com.sun.jna.platform.win32.Crypt32Util;
...
// Get encrypted master key
String pathLocalState = System.getProperty("user.home") + "/AppData/Local/Google/Chrome/User Data/Local State";
JSONObject jsonObjectLocalState = (JSONObject)new JSONParser().parse(new FileReader(pathLocalState));
String encryptedMasterKeyWithPrefixB64 = (String)((JSONObject)jsonObjectLocalState.get("os_crypt")).get("encrypted_key");
// Remove praefix (DPAPI)
byte[] encryptedMasterKeyWithPrefix = Base64.getDecoder().decode(encryptedMasterKeyWithPrefixB64);
byte[] encryptedMasterKey =  Arrays.copyOfRange(encryptedMasterKeyWithPrefix, 5, encryptedMasterKeyWithPrefix.length);
// Decrypt
byte[] masterKey = Crypt32Util.cryptUnprotectData(encryptedMasterKey);

using json-simple, jna-platform and jna.

The encrypted cookie consists of a 3 bytes prefix (ASCII encoding of v10), the 12 bytes nonce followed by the ciphertext and the tag. Since in Java ciphertext and tag are processed in concatenated form, only a separation of nonce and ciphertext/tag is necessary. After that, decryption can be performed. A possible implementation in Java is:

import java.util.Arrays;
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
...
byte[] encryptedCookie = new byte[] {0x76, 0x31, 0x30, ...}; // may contain the encrypted cookie
// Separate praefix (v10), nonce and ciphertext/tag
byte[] nonce = Arrays.copyOfRange(encryptedCookie, 3, 3 + 12);
byte[] ciphertextTag = Arrays.copyOfRange(encryptedCookie, 3 + 12, encryptedCookie.length);
// Decrypt
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
GCMParameterSpec gcmParameterSpec = new GCMParameterSpec(128, nonce);
SecretKeySpec keySpec = new SecretKeySpec(masterKey, "AES");
cipher.init(Cipher.DECRYPT_MODE, keySpec, gcmParameterSpec);
byte[] cookie = cipher.doFinal(ciphertextTag);

Please note that only cookies encrypted with Chrome v80.0 or later can be decrypted this way. Cookies encrypted with earlier Chrome versions must be decrypted using DPAPI.

Answer 2

Chrome locks its Cookie file, so it is not possible to directly modify it if Chrome is running