Encrypting password (DPAPI) for Chrome, results in "0" after every character

Question

Hello everyone!

I'm working on a project where I need to encrypt a known password, and then place it in the Login Data /logins table of Chrome, (for 40 windows users, on the same Windows 2019 server machine).

For "circumstantial" reasons I'm using a batch file from which I call a PowerShell script to encrypt the password, and then, it's updating the password_value in the "logins" table (of Chrome's Login Data db).

When the actual user goes to the login web page, the password is auto-filled in with a zero (or some unknown "unprintable?" character) after every character (in the password input field).

Testing with password value: abc

I’m at a bit at a loss at this point… tried removing zeros or spaces in the powershell script, where at the end I used:

… ; $encryptedPassword -replace '0x', '' "`) do set "passwordHex=%%e"

but it didn’t seem to make any difference (because probably the extra character is neither a space nor a zero…).

I'm pretty sure I'm doing something wrong in the encrypting PowerShell script (hence my post here).

Here's the script I use (PowerShell script called from within the batch file):

@echo off
setlocal EnableDelayedExpansion
set "pwd=abc"

for /f "usebackq delims=" %%e in (`powershell -command "$password='!pwd!';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;$encryptedPassword = ConvertFrom-SecureString $securePassword;$encryptedPassword"`) do set "passwordHex=%%e"

set "chrome_profile_path=!LOCALAPPDATA!\Google\Chrome\User Data\Default"
set "login_db_path=!chrome_profile_path!\Login Data"
echo UPDATE logins SET password_value = X'!passwordHex!' WHERE username_value = '******@hotmail.com'^; > queries.sql

sqlite3.exe "!login_db_path!" < queries.sql

If you happen to notice something obvious, or could possibly point me in the right direction, I'd very much appreciate it!

Thank you,

Andrei

Answer 1

First, trying to remove the zeroes from the encrypted password will produce a value that cannot be decrypted. The "encryptedpassword" is a 460 character encrypted string. not say, an insecure Base64 encoded string.

Second, the encryption can only be decrypted on the machine that encrypted it. Each machine will use its own encryption key to decrypt the string.

Third, why are you mixing CMD and PowerShell?