I'm trying to decrypt encrypted values from the chrome cookie database. I found them in an SQLite file, was able to read most of it, but not the encrypted part. From the research I've done, the encryption key is your windows password and the encryption method is AES 256. However, my function returns nothing. Here's the setup... PHP 8.0.1 Google Chrome: Version 91.0.4472.106 (Official Build) (64-bit) Here's the code...
<?php
function decrypt($data,$key) {
$encrypted = base64_decode($data);
$key = substr(hash('sha256', $key, true), 0, 32);
$cipher = 'aes-256-gcm';
$iv_len = openssl_cipher_iv_length($cipher);
$tag_length = 16;
$iv = substr($encrypted, 0, $iv_len);
$ciphertext = substr($encrypted, $iv_len, -$tag_length);
$tag = substr($encrypted, -$tag_length);
$decrypted = openssl_decrypt($ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);
return $decrypted;
}
$myPDO = new PDO('sqlite:C:\Users\jamwhitl\AppData\Local\Google\Chrome\User Data\Default\Cookies');
$sql = "SELECT * FROM cookies";
$result = $myPDO->query($sql)->fetchAll(PDO::FETCH_ASSOC);
foreach($result as $row)
{
$Data[] = $row;//Dump all rows and keys
echo 'Host: ' . $row['host_key'] .'<br>';
echo 'Name: ' . $row['name'] .'<br>';
echo 'Encrypted: ' . $row['encrypted_value'] .'<br>';
echo 'Decrypted: ' . decrypt($row['encrypted_value'], 'Windows_Password') . '<br><br>';
}
echo '<pre>';
print_r($Data);//Show all rows and keys
echo '</pre>';
?>
An example of the output is...
Host: localhost
Name: PHPSESSID
Encrypted: v10�r�$��ӭ�R���"�A�8���4��Y�I��{T�&)�˄Y!�;O�ι �Ǝ|
Decrypted:
And this data can easily be obtained from the developer tools...
Request Headers
Cookie: PHPSESSID=s1vgajhd3njf8iic50karul62p;
Any help would be appreciated, thank in advance.