🖥🌐 Chrome - TryHackMe Walk Through - 🌐🖥
A password manager is only as strong as the password that encrypts it. You find that a malicious actor extracted something over the network, but what? Help us find out!
📢 Room Link: https://tryhackme.com/room/chrome
📢 📢📢Scripts used on the room:📢📢📢
📢 decompiler / debug transfer.exe (.net) script using:
Linux (AvaloniaILSpy) : https://github.com/icsharpcode/Avalon...
Windows (dnSpy) : https://github.com/dnSpy/dnSpy
Decrypt files encrypted by transfer.exe file:
https://github.com/djalilayed/tryhack...
📢 Web page with useful info:
https://www.hackthebox.com/blog/seize...
📢 Extract the user's hash using DPAPImk2john.py
https://github.com/openwall/john/blob...
📢 Decrypt the DPAPI blob
https://github.com/djalilayed/tryhack...
📢 mimikatz
📢 decrypt the master key
dpapi::masterkey /in:8c6b6187-8eaa-48bd-be16-98212a441580 /sid:S-1-5-21-3854677062-280096443-3674533662-1001 /password:bubbles /protected
d📢 ecrypt the DPAPI blob
dpapi::blob /masterkey:yourmasterkeyfromabovecommand /in:"dec_data" /out:aes.dec
📢 decrypt Chrome's saved passwords locally
Windows: https://github.com/djalilayed/tryhack...
Linux: https://github.com/djalilayed/tryhack...
#tryhackme