-
Notifications
You must be signed in to change notification settings - Fork 1
/
decryption.py
176 lines (135 loc) · 5.72 KB
/
decryption.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
import os
import sys
import glob
import operator
import subprocess
import shutil
import sqlite3
import binascii
import base64
import tempfile
import hmac
from hashlib import sha1
from struct import Struct
from itertools import starmap
_pack_int = Struct('>I').pack
def pbkdf2_alg(data, salt, iterations, keylen=16, hashfunc=None):
hashfunc = hashfunc or sha1
mac = hmac.new(data, None, hashfunc)
def _pseudorandom(x, mac=mac):
h = mac.copy()
h.update(x)
return map(ord, h.digest())
buf = []
for block in range(1, -(-keylen // mac.digest_size) + 1):
rv = u = _pseudorandom(salt + _pack_int(block))
for i in range(iterations - 1):
u = _pseudorandom(''.join(map(chr, u)))
rv = starmap(operator.xor, zip(rv, u))
buf.extend(rv)
return ''.join(map(chr, buf))[:keylen]
try:
from hashlib import pbkdf2_hmac
except ImportError:
pbkdf2_hmac = pbkdf2_alg
def decrypt(encrypted, safe_storage_key):
iv = ''.join(('20', ) * 16)
key = pbkdf2_hmac('sha1', safe_storage_key, b'saltysalt', 1003)[:16]
hex_key = binascii.hexlify(key)
hex_enc_password = base64.b64encode(encrypted[3:])
try:
decrypted = subprocess.check_output(
"openssl enc -base64 -d "
"-aes-128-cbc -iv '{}' -K {} <<<"
"{} 2>/dev/null".format(iv, hex_key, hex_enc_password),
shell=True)
except subprocess.CalledProcessError:
decrypted = "Error decrypting the data"
return decrypted
def db_query(chrome_data, content_type):
# Work around for locking DB
copy_path = tempfile.mkdtemp()
with open(chrome_data, 'r') as content:
dbcopy = content.read()
with open('{}/chrome'.format(copy_path), 'w') as content:
# if chrome is open, the DB will be locked
# so get around this by making a temp copy
content.write(dbcopy)
database = sqlite3.connect('{}/chrome'.format(copy_path))
if content_type == 'Web Data':
sql_query = ('SELECT name_on_card, card_number_encrypted, expiration_month, '
'expiration_year FROM credit_cards')
keys = ['name', 'card', 'exp_m', 'exp_y']
else:
sql_query = ('SELECT username_value, password_value, origin_url '
'FROM logins')
keys = ['user', 'pass', 'url']
db_data = []
with database:
for values in database.execute(sql_query):
if not values[0] or (values[1][:3] != b'v10'):
continue
else:
db_data.append(dict(zip(keys, values)))
shutil.rmtree(copy_path)
return db_data
def utfout(x):
return x.encode('utf-8', errors='replace')
def extract(data, safe_storage_key):
for profile in data:
if 'Web Data' in profile:
db_data = db_query(profile, 'Web Data')
print('Credit Cards')
for i, entry in enumerate(db_data):
entry['card'] = decrypt(entry['card'], safe_storage_key)
cc_dict = {
'3': 'AMEX',
'4': 'Visa',
'5': 'Mastercard',
'6': 'Discover'
}
brand = 'Unknown Card'
if entry['card'][0] in cc_dict:
brand = cc_dict[entry['card'][0]]
with open('credit_cards.txt', 'a') as file:
file.write('[{}] {}\n'.format(i + 1, brand))
file.write('\tCard Holder: {}\n'.format(utfout(entry['name'])))
file.write('\tCard Number: {}\n'.format(utfout(entry['card'])))
file.write('\tExpiration: {}/{}\n\n'.format(utfout(entry['exp_m']), utfout(entry['exp_y'])))
file.close()
print('[{}] {}'.format(i + 1, brand))
print('\tCard Holder: {}'.format(utfout(entry['name'])))
print('\tCard Number: {}'.format(utfout(entry['card'])))
print('\tExpiration: {}/{}'.format(utfout(entry['exp_m']), utfout(entry['exp_y'])))
else:
db_data = db_query(profile, 'Login Data')
print('Passwords')
for i, entry in enumerate(db_data):
entry['pass'] = decrypt(entry['pass'], safe_storage_key)
with open('account_passwords.txt', 'a') as file:
file.write('[{}] {}\n'.format(i + 1, utfout(entry['url'])))
file.write('\tUsername: {}\n'.format(utfout(entry['user'])))
file.write('\tPassword: {}\n\n'.format(utfout(entry['pass'])))
file.close()
print('[{}] {}'.format(i + 1, utfout(entry['url'])))
print('\tUsername: {}'.format(utfout(entry['user'])))
print('\tPassword: {}'.format(utfout(entry['pass'])))
if __name__ == '__main__':
root_path = os.path.expanduser('~') + '/Library/Application Support/Google/Chrome/Profile 3'
login_data_path = os.path.join(root_path, 'Login Data')
cc_data_path = os.path.join(root_path, 'Web Data')
data = glob.glob(login_data_path) + glob.glob(cc_data_path)
safe_storage_key = subprocess.Popen(
"security find-generic-password -wa "
"'Chrome'",
stderr=subprocess.PIPE,
stdout=subprocess.PIPE,
shell=True)
stdout, stderr = safe_storage_key.communicate()
if stderr:
print('Error: {}. Chrome entry not found in keychain.'.format(stderr))
sys.exit()
if not stdout:
print('User clicked deny')
safe_storage_key = stdout.replace('\n', '')
extract(data, safe_storage_key)