[Perl]Chrome浏览器 cookies 数据提取和解密

523066680

声明, 这个方案是2020年做的, 已经不适用于新版本的chrome. 但是网上搜寻一下也可以找到对应新版本的方案.

最初需求是通过perl mojo模块批量处理一些跨境电商的产品数据, 统计友商的信息, 当时的接口访问已经有些严格, 无法完全在本地实现模拟登录.
于是尝试通过获取浏览器一致的cookies的方式来模拟请求 (selecnium 考虑过, 只要使用这个模块, 就会不断要求验证)

cookies 数据位置:
C:/Users/'.$ENV{"USERNAME"}.'/AppData/Local/Google/Chrome/User Data/Default/Cookies

这个文件在chrome打开的情况下无法复制副本, 可以用 sqlite 打开查看键值对(加密的).

以下是一些旧的笔记

• chrome-80-how-to-decode-cookies
• AES算法（五）GCM工作模式
• How to extract cookies from an existing browser session
  

以一个时间较早的脚本作为参考(2015年), 其中 decryptData 可以用来解密 $secret_key，但其他部分已经无法获取结果。
decryptchromecookies.pl

1. #!/usr/bin/perl -w
   
2. 
   
3. use File::Copy qw(copy);
   
4. use DBI;
   
5. use Win32::API;
   
6. 
   
7. use strict;
   
8. use warnings;
   
9. 
   
10. print ("Decrypting cookies...\n") && &fix_cookies && print ("Cookies decrypted!\n");
    
11. 
    
12. sub fix_cookies
    
13. {
    
14.         #Chrome has been encrypting cookie values since Chrome..33?
    
15.         #We need to decrypt the value before we can use it.
    
16. 
    
17.         my $chrome_cookie_file = 'C:/Users/'.$ENV{"USERNAME"}.'/AppData/Local/Google/Chrome/User Data/Default/Cookies';
    
18.         copy($chrome_cookie_file, 'Cookies') || die "Failed to move files: $!";;
    
19. 
    
20.         my $dbc = DBI->connect("dbi:SQLite:dbname=Cookies", '', '', { RaiseError => 1, AutoCommit => 0});
    
21. 
    
22.         my @rows = @{$dbc->selectall_arrayref("SELECT host_key, name, value, encrypted_value FROM cookies")};
    
23.         foreach my $row (@rows){
    
24.                 my ($host_key, $name, $value, $encrypted_value) = @{$row};
    
25. 
    
26.                 my $new_value = decryptData($encrypted_value) || $value || '0';
    
27. 
    
28.                 #This is optional, but it allows us to use any session cookies that may exist at the time of running this.
    
29.                 #This is assuming that you will be generating a new decrypted session file whenever you run your script.
    
30.                 my $sth = $dbc->prepare(qq{
    
31.                         UPDATE cookies SET value = ?, has_expires = 1, expires_utc = 99999999999999999, is_persistent = 1
    
32.                         WHERE host_key = ?
    
33.                         AND name = ?
    
34.                 });
    
35.                 $sth->execute($new_value, $host_key, $name);
    
36.         }
    
37. 
    
38.         $dbc->commit(); #SQLite is slow at excuting one row at a time. SEE: http://stackoverflow.com/a/8882184
    
39.         $dbc->disconnect();
    
40. }
    
41. 
    
42. sub decryptData
    
43. {
    
44.         #Cleaned up version of http://www.perlmonks.org/?node_id=776481
    
45.         my $encryptedData = shift;
    
46. 
    
47.         if($encryptedData eq ''){ return undef; } #avoid errors...
    
48. 
    
49.         my $pDataIn = pack('LL', length($encryptedData)+1, unpack('L!', pack('P', $encryptedData)));
    
50. 
    
51.         my $DataOut;
    
52.         my $pDataOut = pack('LL', 0, 0);
    
53. 
    
54.         my $CryptUnprotectData = Win32::API->new('Crypt32', 'CryptUnprotectData', ['P', 'P', 'P', 'P', 'P', 'N', 'P'], 'N');
    
55.         if($CryptUnprotectData->Call($pDataIn, pack('L', 0), 0, pack('L', 0), pack('L4', 16, 0, 0, unpack('L!', pack('P', 0))), 0, $pDataOut)){
    
56.                 my($len, $ptr) = unpack('LL', $pDataOut);
    
57.                 $DataOut = unpack('P'.$len, pack('L!', $ptr));
    
58.                 return $DataOut;
    
59.         }else{
    
60.                 return undef;
    
61.         }
    
62. }

复制代码

脚本行为：先复制cookies到当前目录，读取并尝试解密，将解密数据重新写入数据库。
实测decrypt后的new_value值为0，解密失败。

在这个基础上做了一些修改, 实现了获取 aliexpress.com cookies 的模块

1. package GetAliExCookies;
   
2. 
   
3. use utf8;
   
4. use Encode;
   
5. use File::Slurp;
   
6. use Mojo::UserAgent;
   
7. use MIME::Base64;
   
8. 
   
9. # metacpan 搜索 GCM 找到该模块
   
10. use Crypt::AuthEnc::GCM qw(gcm_encrypt_authenticate gcm_decrypt_verify);
    
11. use DBI;
    
12. use Win32::API;
    
13. use File::Copy;
    
14. use JSON qw/from_json to_json/;
    
15. STDOUT->autoflush(1);
    
16. 
    
17. sub get_ck_str
    
18. {
    
19.     my $f1 = "C:/Users/". $ENV{"USERNAME"} ."/AppData/Local/Google/Chrome/User Data/Local State";
    
20.     my $data = from_json( scalar(read_file($f1)) );
    
21.     # encrypt_key 前5位是 "DPAPI"
    
22.     my $enc_key = decode_base64( $data->{'os_crypt'}{'encrypted_key'} );
    
23.     $enc_key = substr($enc_key, 5);
    
24.     my $dec_key = decryptData( $enc_key );
    
25.     #print_hex($dec_key);
    
26. 
    
27.     # -M $f: time minus file modification time, in days.
    
28.     #if ( (not -e "Cookies") or (-M "Cookies") > 7 ) {
    
29.         # 2021-12 update path C:\Users\${USERNAME}\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
    
30.         my $chrome_cookie_file = 'C:/Users/'.$ENV{"USERNAME"}.'/AppData/Local/Google/Chrome/User Data/Default/Network/Cookies';
    
31.         copy($chrome_cookie_file, 'Cookies') || die "Failed to get cookies: $!";;
    
32.     #}
    
33. 
    
34.     my $dbc = DBI->connect("dbi:SQLite:dbname=Cookies", '', '', { RaiseError => 1, AutoCommit => 0});
    
35. 
    
36.     my %names = map {$_ => 1} qw/
    
37.         _lang
    
38.         acs_usuc_t
    
39.         aep_usuc_t
    
40.         xman_us_t
    
41.         aep_usuc_f
    
42.         xman_us_f
    
43.         xman_t
    
44.         intl_locale
    
45.         /;
    
46.     my $ckstr = "";
    
47.     my @rows = @{$dbc->selectall_arrayref("SELECT host_key, name, value, encrypted_value FROM cookies")};
    
48.     for my $row (@rows)
    
49.     {
    
50.         my ($host_key, $name, $value, $encrypted_value) = @{$row};
    
51.         next unless ( $host_key eq ".aliexpress.com" );
    
52.         next unless ( exists $names{$name} );
    
53. 
    
54.         # 加密数据以 v10 的 ASCII 编码（即 0x763130）开始，然后是 12 字节的随机数、实际密文，最后是 16 字节的认证标签。 可以按如下方式分离各个组件：
    
55.         my $nonce = substr($encrypted_value, 3, 12);
    
56.         my $ciphertext = substr($encrypted_value, 3+12, -16);
    
57.         my $tag = substr($encrypted_value, -16);
    
58. 
    
59.         my $plaintext = gcm_decrypt_verify('AES', $dec_key, $nonce, undef, $ciphertext, $tag);
    
60.         #printf "%s = %s\n", $name, $plaintext;
    
61. 
    
62.         $ckstr .= "${name}=${plaintext}; ";
    
63. 
    
64.     }
    
65. 
    
66.     #$dbc->commit(); #SQLite is slow at excuting one row at a time. SEE: http://stackoverflow.com/a/8882184
    
67.     $dbc->disconnect();
    
68. 
    
69.     return $ckstr;
    
70. }
    
71. 
    
72. sub decryptData
    
73. {
    
74.     #Cleaned up version of http://www.perlmonks.org/?node_id=776481
    
75.     my $encryptedData = shift;
    
76.     if($encryptedData eq ''){ return undef; } #avoid errors...
    
77.     my $pDataIn = pack('LL', length($encryptedData)+1, unpack('L!', pack('P', $encryptedData)));
    
78. 
    
79.     my $DataOut;
    
80.     my $pDataOut = pack('LL', 0, 0);
    
81. 
    
82.     my $CryptUnprotectData = Win32::API->new('Crypt32', 'CryptUnprotectData', ['P', 'P', 'P', 'P', 'P', 'N', 'P'], 'N');
    
83.     if($CryptUnprotectData->Call($pDataIn, pack('L', 0), 0, pack('L', 0), pack('L4', 16, 0, 0, unpack('L!', pack('P', 0))), 0, $pDataOut)){
    
84.         my($len, $ptr) = unpack('LL', $pDataOut);
    
85.         $DataOut = unpack('P'.$len, pack('L!', $ptr));
    
86.         return $DataOut;
    
87.     }else{
    
88.         return undef;
    
89.     }
    
90. }
    
91. 
    
92. 1;
    

复制代码