SharpDPAPI icon indicating copy to clipboard operation
SharpDPAPI copied to clipboard

Cookie unprotect Not working with latest chrome version 104

Open Zer0-Tolerance opened this issue 3 years ago • 1 comments

Hi Will, I think This command doesn't work anymore: SharpChrome.exe cookies /unprotect since the location of the cookie file is now C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Network.

output taken From the BH2022 ATTA lab:

__                 _
(_  |_   _. ._ ._  /  |_  ._ _  ._ _   _
__) | | (_| |  |_) \_ | | | (_) | | | (/_
               |
 v1.11.1


[*] Action: Chrome Saved Cookies Triage

[*] Triaging non-expired cookies. Use '/showall' to display ALL cookies.

[*] Triaging Chrome Cookies for current user


[*] AES state key file : C:\Users\thor\AppData\Local\Google\Chrome\User Data\Local State
[*] AES state key      : 001B279C498A9BA70B76E301E45D7B2752475FEFA2690EAA17BAE06616489018

Zer0-Tolerance avatar Aug 08 '22 23:08 Zer0-Tolerance

Hi Will, I think This command doesn't work anymore: SharpChrome.exe cookies /unprotect since the location of the cookie file is now C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Network.

output taken From the BH2022 ATTA lab:

__                 _
(_  |_   _. ._ ._  /  |_  ._ _  ._ _   _
__) | | (_| |  |_) \_ | | | (_) | | | (/_
               |
 v1.11.1


[*] Action: Chrome Saved Cookies Triage

[*] Triaging non-expired cookies. Use '/showall' to display ALL cookies.

[*] Triaging Chrome Cookies for current user


[*] AES state key file : C:\Users\thor\AppData\Local\Google\Chrome\User Data\Local State
[*] AES state key      : 001B279C498A9BA70B76E301E45D7B2752475FEFA2690EAA17BAE06616489018

use this https://github.com/moonD4rk/HackBrowserData

prisonerr627 avatar Jun 10 '23 08:06 prisonerr627