How can I read/decrypt the encrypted_value column in the chrome sqlite database using powershell?

cookies, encryption, google-chrome, powershell, sqlite

Solution

Adapted to Powershell from this answer: Encrypted cookies in Chrome

# Load System.Security assembly
Add-Type -AssemblyName System.Security

# Decrypt cookie
$ByteArr = [System.Security.Cryptography.ProtectedData]::Unprotect(
                $db_dataset.Tables[0].encrypted_value,
                $null,
                [System.Security.Cryptography.DataProtectionScope]::CurrentUser
            )

# Convert to string
$DecryptedCookie = [System.Text.Encoding]::ASCII.GetString($ByteArr)

I also advise you to change the way you getting the path to the cookies DB, because it's unreliable. In fact, it doesn't works on my machine, because, I've renamed user, but profile folder still keeps it's old name. Use Environment.GetFolderPath method instead:

# Get Cookies DB path
[string]$db_data_source = Join-Path -Path [Environment]::GetFolderPath('LocalApplicationData') -ChildPath 'Google\Chrome\User Data\Default\Cookies'

Problem

I'm trying to read the contents of a cookie (to use for authentication in a script), but the value is stored as some sort of encrypted value in the chrome sqlite database. Is there any way to decrypt this using powershell? Right now I can read the value out of the database using a script like this: ``` [string]$sqlite_library_path = "C:\Path\To\System.Data.SQLite.dll" [string]$db_data_source = "C:\Users\$env:USERNAME\AppData\Local\Google\Chrome\User Data\Default\Cookies" [string]$db_query = "SELECT * FROM cookies WHERE name='cookiename' AND host_key='servername'" [void][System.Reflection.Assembly]::LoadFrom($sqlite_library_path) $db_dataset = New-Object System.Data.DataSet $db_data_adapter = New-Object System.Data.SQLite.SQLiteDataAdapter($db_query,"Data Source=$db_data_source") [void]$db_data_adapter.Fill($db_dataset) $db_dataset.Tables[0].encrypted_value ``` The problem is that the encryped value that is returned is unusable. How can I convert this into a usable value?

Original source

Related problems