Add support for decrypting Chrome and Edge v20 cookies and passwords

dissect/target/plugins/apps/browser/browser.py

@@ -80,10 +80,12 @@
     ("string", "browser"),
     ("varint", "id"),
     ("uri", "url"),
-    ("string", "encrypted_username"),
-    ("string", "encrypted_password"),
+    ("bytes", "encrypted_username"),
+    ("bytes", "encrypted_password"),
+    ("bytes", "encrypted_notes"),
     ("string", "decrypted_username"),
     ("string", "decrypted_password"),
+    ("string", "decrypted_notes"),
     ("path", "source"),
 ]
 

dissect/target/plugins/apps/browser/firefox.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import base64
 import hmac
 import json
 import logging
@@ -494,8 +495,8 @@ def passwords(self) -> Iterator[BrowserPasswordRecord]:
                         browser="firefox",
                         id=login.get("id"),
                         url=login.get("hostname"),
-                        encrypted_username=login.get("encryptedUsername"),
-                        encrypted_password=login.get("encryptedPassword"),
+                        encrypted_username=base64.b64decode(login.get("encryptedUsername", "")),
+                        encrypted_password=base64.b64decode(login.get("encryptedPassword", "")),
                         decrypted_username=decrypted_username,
                         decrypted_password=decrypted_password,
                         source=login_file,

tests/conftest.py

@@ -11,6 +11,7 @@
 from dissect.target.exceptions import RegistryKeyNotFoundError
 from dissect.target.filesystem import Filesystem, VirtualFilesystem, VirtualSymlink
 from dissect.target.filesystems.tar import TarFilesystem
+from dissect.target.helpers import keychain
 from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
 from dissect.target.plugin import _generate_long_paths
@@ -553,3 +554,11 @@ def target_unix_factory(tmp_path: pathlib.Path) -> TargetUnixFactory:
     """This fixture returns a class that can instantiate a virtual unix targets from a blueprint. This can then be used
     to create a fixture for the source target and the desination target, without them 'bleeding' into each other."""
     return TargetUnixFactory(tmp_path)
+
+
+@pytest.fixture
+def guarded_keychain() -> Iterator[None]:
+    """This fixture clears the keychain from any previously added values."""
+    keychain.KEYCHAIN.clear()
+    yield
+    keychain.KEYCHAIN.clear()

tests/helpers/test_keychain.py

@@ -1,23 +1,10 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import TYPE_CHECKING
-
-import pytest
 
 from dissect.target.helpers import keychain
 from tests._utils import absolute_path
 
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-
-@pytest.fixture
-def guarded_keychain() -> Iterator[None]:
-    keychain.KEYCHAIN.clear()
-    yield
-    keychain.KEYCHAIN.clear()
-
 
 def test_keychain_register_keychain_file(guarded_keychain: None) -> None:
     keychain_file = Path(absolute_path("_data/helpers/keychain/keychain.csv"))

tests/plugins/apps/browser/test_brave.py

@@ -17,9 +17,9 @@ def target_brave(target_win_users: Target, fs_win: VirtualFilesystem) -> Target:
     base_path_default = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default"
     base_path_profile = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1"
     files = [
-        ("History", "_data/plugins/apps/browser/chrome/History"),
-        ("Preferences", "_data/plugins/apps/browser/chrome/Preferences"),
-        ("Secure Preferences", "_data/plugins/apps/browser/chrome/Secure Preferences"),
+        ("History", "_data/plugins/apps/browser/chrome/generic/History"),
+        ("Preferences", "_data/plugins/apps/browser/chrome/generic/Preferences"),
+        ("Secure Preferences", "_data/plugins/apps/browser/chrome/generic/Secure Preferences"),
         ("Network\\Cookies", "_data/plugins/apps/browser/chromium/Cookies"),
         ("Login Data", "_data/plugins/apps/browser/chromium/Login Data"),
     ]