One Day Sec

What are the steps to perform offline extraction of Chrome saved passwords using the Master Key approach?

First, obtain the `Login Data` SQLite database from `%LocalAppData%\Google\Chrome\User Data\Default\`. Second, acquire the lsass process memory dump (e.g., using procdump). Finally, use mimikatz locally to load the dump, extract the Master Key with `sekurlsa::dpapi`, and then decrypt the DPAPI blob with `dpapi::blob /in:test.txt` to retrieve the plaintext passwords. No plaintext password from the target user is required.
Login DataSQLitelsass dumpprocdumpmimikatzdpapi::blobplaintext passwords

Browse all Q&A →