Chromepass : Hacking Chrome Saved Passwords

Chromepass is a python-based console application that generates a windows executable with the following features:

  • Decrypt Chrome saved paswords
  • Send a file with the login/password combinations remotely (email or reverse-http)
  • Custom icon
  • Completely undetectable by AntiVirus Engines

AV Detection

Due to the way this has been coded, it is currently fully undetected. Here are some links to scans performed using a variety of websites

  • VirusTotal Scan (0/68) 30-09-2019
    • this is an educational project, so distribution (or the lack thereof) is not a concern, hence the usage of VirusTotal
  • AntiScan (0/26) 24-09-2019
  • Hibrid Analysis All Clean (CrowdStrike Falcon, MetaDefender and Virustotal) 24-09-2019

Getting Started

Dependencies & Requirements

This is a very simple application, which uses only:

  • Python – Only tested on 3.7.4 but should work in 3.6+

Installation

  • Chromepass requires Python 3.6+ to run.
  • Install the dependencies:

> cd chromepass
> pip install -r requirements.txt

If any errors occur make sure you’re running on the proper environment (if applcable) and that you have python 3.6+ (preferably 3.7.4). If the errors persist, try:

> python -m pip install –upgrade pip
> python -m pip install -r requirements.txt

Usage

Chromepass is very straightforward. Start by running:

> python create_server.py

It will ask you to select between two options:

  • (1) via email [To be fixed]
    • This will ask you for an email address and a password
    • It will then ask you if you wish to send to another address or to yourself
    • Next, you’re asked if you want to display an error message. This is a fake message that if enabled will appear when the victim opens the executable, after the passwords have been transferred.
    • You can then write your own message or leave it blank
    • You’re done! Wait for the executable to be generated and then it’s ready.
  • (2) via client.exe [Recommended at the moment]
    • First you’re asked to input an IP Address for a reverse connection. This is the address that belongs to the attacker. It can be a local IP address or a remote IP Address. If a remote address is chosen, Port Forwarding needs to be in place.
    • You’re then asked if you want to display an error message. This is a fake message that if enabled will appear when the victim opens the executable, after the passwords have been transferred.
    • You can then write your own message or leave it blank
    • You’re done! Wait for the executables to be generated and then it’s ready.
    • The client.exe must be started before the server_ip.exe. The server_ip.exe is the file the victim receives.

Note: To set a custom icon, replace icon.ico by the desired icon with the same name and format.

Also Read – Frida-Fuzzer : Experimental Fuzzer Used For API In-Memory Fuzzing

Todo

  • Sending Real-time precise location of the victim (completed, releases next update)
  • Also steal Firefox passwords (Completed, releases next update)
  • Option of installing a backdoor allowing remote control of the victim’s computer (completed, releases next update)
  • Support for more email providers (in progress)
  • Also steal passwords from other programs, such as keychains(in progress)
  • Add Night Mode (in progress)

Errors, Bugs & feature requests

If you find an error or a bug, please report it as an issue. If you wish to suggest a feature or an improvement please report it in the issue pages.

Please follow the templates shown when creating the issue.

Learn More

For access to a community full of aspiring computer security experts, ranging from the complete beginner to the seasoned veteran, join our Discord Server: WhiteHat Hacking

If you wish to contact me, you can do so via: marionascimento@itsec.us

Disclaimer

I am not responsible for what you do with the information and code provided. This is intended for professional or educational purposes only.