Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding support for Chromium browser #26

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Adding support for Chromium browser #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ SharpDPAPI is licensed under the BSD 3-Clause license.
/target:FILE - triage a specific 'Cookies', 'Login Data', or 'Local State' file location
/target:C:\Users\X\ - triage a specific user folder for any specified command
/server:SERVER - triage a remote server, assuming admin access (note: must use with /pvk:KEY)
/browser:X - triage 'chrome' (the default) or (chromium-based) 'edge'
/browser:X - triage 'chrome' (the default) or (chromium-based) 'chromium', 'edge', 'brave'

Output:
/format:X - either 'csv' (default) or 'table' display
Expand Down
2 changes: 1 addition & 1 deletion SharpChrome/Commands/Logins.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ public void Execute(Dictionary<string, string> arguments)
bool unprotect = false; // whether to force CryptUnprotectData()
bool quiet = false; // don't display headers/logos/etc. (for csv/json output)
string stateKey = ""; // decrypted AES statekey to use for cookie decryption
string browser = "chrome"; // alternate Chromiun browser to specify, currently supported: "chrome", "edge", "brave"
string browser = "chrome"; // alternate Chromiun browser to specify, currently supported: "chrome", "chromium", "edge", "brave"
string target = ""; // target file/user folder to triage


Expand Down
2 changes: 1 addition & 1 deletion SharpChrome/Domain/Info.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ public static void ShowUsage()
/target:FILE - triage a specific 'Cookies', 'Login Data', or 'Local State' file location
/target:C:\Users\X\ - triage a specific user folder for any specified command
/server:SERVER - triage a remote server, assuming admin access (note: must use with /pvk:KEY)
/browser:X - triage 'chrome' (the default) or (chromium-based) 'edge'/'brave'
/browser:X - triage 'chrome' (the default) or (chromium-based) 'chromium'/'edge'/'brave'

Output:
/format:X - either 'csv' (default) or 'table' display
Expand Down
19 changes: 17 additions & 2 deletions SharpChrome/lib/Chrome.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,11 @@ public static void TriageChromeLogins(Dictionary<string, string> MasterKeys, str
loginDataPath = String.Format("{0}\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", userDirectory);
aesStateKeyPath = String.Format("{0}\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", userDirectory);
}
else if (browser.ToLower() == "chromium")
{
loginDataPath = String.Format("{0}\\AppData\\Local\\Chromium\\User Data\\Default\\Login Data", userDirectory);
aesStateKeyPath = String.Format("{0}\\AppData\\Local\\Chromium\\User Data\\Local State", userDirectory);
}
else if (browser.ToLower() == "edge")
{
loginDataPath = String.Format("{0}\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data", userDirectory);
Expand All @@ -129,7 +134,7 @@ public static void TriageChromeLogins(Dictionary<string, string> MasterKeys, str
}
else
{
Console.WriteLine("[X] ERROR: only 'chrome', 'edge', and 'brave' are currently supported for browsers.");
Console.WriteLine("[X] ERROR: only 'chrome', 'chromium', 'edge', and 'brave' are currently supported for browsers.");
return;
}

Expand Down Expand Up @@ -248,6 +253,15 @@ public static void TriageChromeCookies(Dictionary<string, string> MasterKeys, st
}
aesStateKeyPath = String.Format("{0}\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", userDirectory);
}
else if (browser.ToLower() == "chromium")
{
cookiePath = String.Format("{0}\\AppData\\Local\\Chromium\\User Data\\Default\\Cookies", userDirectory);
if (!File.Exists(cookiePath))
{
cookiePath = String.Format("{0}\\AppData\\Local\\Chromium\\User Data\\Default\\Network\\Cookies", userDirectory);
}
aesStateKeyPath = String.Format("{0}\\AppData\\Local\\Chromium\\User Data\\Local State", userDirectory);
}
else if (browser.ToLower() == "edge")
{
cookiePath = String.Format("{0}\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Cookies", userDirectory);
Expand All @@ -268,7 +282,7 @@ public static void TriageChromeCookies(Dictionary<string, string> MasterKeys, st
}
else
{
Console.WriteLine("[X] ERROR: only 'chrome', 'edge', and 'brave' are currently supported for browsers.");
Console.WriteLine("[X] ERROR: only 'chrome', 'chromium', 'edge', and 'brave' are currently supported for browsers.");
return;
}

Expand Down Expand Up @@ -362,6 +376,7 @@ public static void TriageStateKeys(Dictionary<string, string> MasterKeys, string
string[] aesKeyPaths = new string[]
{
$"{userDirectory}\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
$"{userDirectory}\\AppData\\Local\\Chromium\\User Data\\Local State",
$"{userDirectory}\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
$"{userDirectory}\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Local State"
};
Expand Down