search

moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
MIT License
11.19k stars 1.57k forks source link

[BUG] Unable to export Chrome passwords in macOS Time Machine backup. #287

Closed MilesYM closed 10 months ago

MilesYM commented 10 months ago

Describe the bug

I've been running ./hack-browser-data -vv and the passwords exported are all wrong (still encrypted?)

Log Output

[...] level=WARN source=browser.go:56 msg="find browser success" browser=chrome_def level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_12 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_16 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_10 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_default level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_18 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_guest_user level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_25 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_11 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_29 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_7 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_24 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_23 level=WARN source=browser.go:56 msg="find browser success" browser=chrome_user_28 level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_def level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_def_sessionstorage.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_12 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_12_history.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_16 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_download.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_16_extension.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_10 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_10_history.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_default level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_download.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_default_bookmark.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_18 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_18_localstorage.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_guest_user level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_guest_user_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_guest_user_bookmark.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_25 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_25_extension.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_11 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_bookmark.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_download.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_11_extension.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_29 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_29_localstorage.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_7 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_7_sessionstorage.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_24 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_24_password.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_23 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_extension.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_23_cookie.csv level=INFO source=chromium_darwin.go:58 msg="get master key success" browser=chrome_user_28 level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_28_cookie.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_28_localstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_28_history.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_28_password.csv level=WARN source=browsingdata.go:72 msg="export success" filename=chrome_user_28_sessionstorage.csv level=WARN source=browsingdata.go:72 msg="export success" filename=firefox_ipsy3rzh_default_1579078565565_password.csv [...]

Expected vs Actual Behavior

The exported files all contain passwords that are gibberish

Desktop (please complete the following information):

Select the operating system(s) you are using:

Additional Details

Checklist

Screenshots/Videos

Screenshot 2024-01-17 at 7 04 11 PM

Additional context

I am trying to retrieve passwords from a time machine, I updated to a new mac, and lost all of my stored passwords. So maybe the master key is different between the 2 macs when decrypting passwords?

Thank you so much

moonD4rk commented 10 months ago

@MilesYM I was able to export passwords when testing on my own Mac (M1). If restoring browser passwords through Time Machine backup, it is possible that the master password for the new system may be different from the previous one, resulting in decryption failure of the passwords.

How about the cookies? Can they be exported successfully?

MilesYM commented 10 months ago

Thanks for your prompt response. The value of the cookie is also encrypted.

What can I do? I still have the time machine backup on my HDD.

Thx

moonD4rk commented 10 months ago

@MilesYM Try to see if the official Google Password Manager works.

Settings -> Autofill and passwords -> Google Password Manager -> Settings -> Download File

MilesYM commented 10 months ago

Unfortunately, it does not let me download this file, these passwords are not showing up in my Google Chrome, even though they are listed there. Do you know how if I can find the master password for my old system somewhere in the time machine? Where do you find this master password? Does it have a name maybe I can search online.

Thanks for your amazing support.

moonD4rk commented 10 months ago

@MilesYM The masterkey of the Apple ecosystem is stored in the keychain and may generate new keys with operating system updates. For more information, please refer to relevant articles on keychains:

MilesYM commented 10 months ago

Thank you, once I find this key, how can I edit your script to use a specific key to decrypt the passwords?

moonD4rk commented 10 months ago

By using this method to obtain the masterKey, it shows that there is no problem with the operation of theHackBrowserData. However, what has been obtained is the latest key instead of the one previously used for encryption and decryption on the operating system. You can try syncing Chrome data to Windows or use Google Password Manager to export passwords.