[Python] Cookies: Couldn't able to extract chrome / edge v20 cookies using AES Decryption in...

Problem: To read the chrome / edge cookies to extract the XSRF-Token and .AspNet.Cookies values of an user in the browser launched from a desktop application and save it in the registry keys

I used the below code and it was working fine for last 2 months and all of sudden a day back, Secret key was able to extract like asusual, but initialisation vector and encrypted password seems to be different than earlier, both the keys seems to be extracting , but faced with the issue : 'utf-8' codec can't decode byte 0xf0 in position 0: invalid continuation byte

due to the inproper value extraction, please refer to the values after the code.

import os
import win32crypt
from Crypto.Cipher import AES
import base64
import sqlite3
import json
import winreg as reg

#Extracting the secret key
def get_aes_key():
local_state_path = 'C:/Users/<username>/AppData/Local/Google/Chrome/User Data/Local state' # Update with your path
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state_data = json.load(f)
encrypted_key = local_state_data['os_crypt']['encrypted_key']
print(encrypted_key)
encrypted_key_base64_dpapi = base64.b64decode(encrypted_key)
print(encrypted_key_base64_dpapi)
encrypted_key_base64 = encrypted_key_base64_dpapi[5:] # Strip 'DPAPI' prefix
encrypted_key_base64 = win32crypt.CryptUnprotectData(encrypted_key_base64, None, None, None, 0)[1]
aes_key = encrypted_key_base64 # Strip DPAPI prefix
return aes_key

def decrypt_payload(cipher, payload):
return cipher.decrypt(payload)

def generate_cipher(aes_key, iv):
return AES.new(aes_key, AES.MODE_GCM, iv)

# Function to decrypt cookie value using AES
def decrypt_aes(dec_aes_key, encrypted_data):
try:
# (3-a) Initialisation vector for AES decryption
initialisation_vector = encrypted_data[3:15]
# (3-b) Get encrypted password by removing suffix bytes (last 16 bits)
# Encrypted password is 192 bits
encrypted_password = encrypted_data[15:-16]
# (4) Build the cipher to decrypt the ciphertext
cipher = generate_cipher(dec_aes_key, initialisation_vector)
decrypted_pass = decrypt_payload(cipher, encrypted_password)
decrypted_pass = decrypted_pass.decode()
return decrypted_pass
except Exception as e:
print("%s" % str(e))
print("[ERR] Unable to decrypt, Chrome version <80 not supported. Please check.")
return ""

# Path to Chrome's Cookies database
logged_in_user = os.getlogin()
cookies_db = 'C:/Users/' + logged_in_user + '/AppData/Local/Google/Chrome/User
Data/Default/Network/Cookies'

# Connect to the Cookies database
conn = sqlite3.connect(cookies_db)
cursor = conn.cursor()

aes_key = get_aes_key()
print(aes_key)

# Example query to fetch cookies
cursor.execute('SELECT host_key, name, encrypted_value FROM cookies')


def set_environment_variable(name, value):
try:
# Open the registry key for environment variables
with reg.OpenKey(reg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\Session Manager\Environment', 0, reg.KEY_SET_VALUE) as key:
# Set the environment variable
reg.SetValueEx(key, name, 0, reg.REG_SZ, value)
print(f'Successfully set {name} to {value}')
except PermissionError:
print("Permission denied. You need to run this script with administrative privileges.")
except Exception as e:
print(f'Failed to set environment variable: {e}')


for row in cursor.fetchall():
host_key, name, encrypted_value = row
if host_key == "adregression02":
#print(f'Name: {name}, encrypted value: {encrypted_value}')
decrypted_value = decrypt_aes(aes_key, encrypted_value)
#print(f'Name: {name}, Decrypted Value: {decrypted_value.decode("utf-8")}')
print("Name: %s\ncookie: %s\n" % (name, decrypted_value))
set_environment_variable(name, decrypted_value)

conn.close()


I think the issue is with the lines below :

def decrypt_aes(dec_aes_key, encrypted_data):
try:
# (3-a) Initialisation vector for AES decryption
initialisation_vector = encrypted_data[3:15]
# Encrypted password is 192 bits
encrypted_password = encrypted_data[15:-16]
# (4) Build the cipher to decrypt the ciphertext
cipher = generate_cipher(dec_aes_key, initialisation_vector)
decrypted_pass = decrypt_payload(cipher, encrypted_password)
decrypted_pass = decrypted_pass.decode()
return decrypted_pass


Below are the values that's extracted :

Name: XSRF-TOKEN, encrypted value: b"v20>QT\xc3.A^E\x85\xc6c+\xac\x0eT\xa3z\xe4\x94\xaa!\x83\x99?\x1e\x04\xdd\x1ad\xbc\x15\r\xf7\x18\x86-\x0bVi\xae\xe8\x0b\x12\x16\xf9+\xb5\xcb\xf8I\x8d\xa9\x1ez\x13\x1fwt\xa5\xb2\x8e\x1dW\xfd\xa1\x99;\xe1\xdc\x8cw[\x05\xd72z\xbfHNm\x05\xcb\x02\xc1\xf5\r\xdd\x9d\xfe\x80\r\x9a:\x81\xcc\x88\xd7-uj\xfe\x9c\xe1\x19\xeb\xbb?@ \x17\xa2\xd1\x87\xc6\xba\x8b\r'\xf1n\r\x1e\x0bK\xad-\xa3r\x1c4d\x93\x14\x9ae\xbca\xfc\xce%\xedc\xf6\x0b/R\xe1\xa1\xe8\xb9\x02_Y\x01\xcd\xe4\xd1\x90@"`

**initialisation_vector--** b'>QT\xc3.A^E\x85\xc6c+'

**encrypted_password--** b"\xac\x0eT\xa3z\xe4\x94\xaa!\x83\x99?\x1e\x04\xdd\x1ad\xbc\x15\r\xf7\x18\x86-\x0bVi\xae\xe8\x0b\x12\x16\xf9+\xb5\xcb\xf8I\x8d\xa9\x1ez\x13\x1fwt\xa5\xb2\x8e\x1dW\xfd\xa1\x99;\xe1\xdc\x8cw[\x05\xd72z\xbfHNm\x05\xcb\x02\xc1\xf5\r\xdd\x9d\xfe\x80\r\x9a:\x81\xcc\x88\xd7-uj\xfe\x9c\xe1\x19\xeb\xbb?@ \x17\xa2\xd1\x87\xc6\xba\x8b\r'\xf1n\r\x1e\x0bK\xad-\xa3r\x1c4d\x93\x14\x9ae\xbca\xfc\xce%\xedc\xf6\x0b/R\xe1\xa1\xe8\xb9\x02_Y\x01\xcd\xe4\xd1\x90@"`

Expected xsrf-token : v3eMK3iMPhdF8tumLxbjEHmSVqwT__4MFAhhFZH6-lP4ffXhfPvACW8oQYuxpQ8OZnI0y8-sVjwc4TobVGDjNTXFlrFI287t5B_SNah9yQSHVkppuRsT510cJXGT05IU9rlJibfMnu-iU4CRk--XyrZ7iOJSugxlKFukH8hDyJ--Gv_F6AUqIo6bFJ1i-10cu7bkZ4hLEvfhdk2q08tKyTn7e6oDfQ6nLicSoKIWjuPvEutpZIZQyK4li32GPirk_ysUKolUbLrl2AjwPVFrCZbgil8yHKyNrmAveY1b0lNNzsDljzsfF_TMLZazpYbbIvEarQuPe6wkL8sQuT-L9YpitNpeW8Wvfgyj96EWCbQ

Can someone please point out what's am missing? or the edge/chrome updated their encryption ?

Right now the encryption update seems to be start with V20 in which the cookie encryption standard has been updated from V10 to V20 since chrome version 127.

I referred the links : https://ohyicong.medium.com/how-to-hack-chrome-password-with-python-1bedc167be3d

Continue reading...