Skip to content

Fix #1139 : Add support for Google Chrome v137+ app bound key decryption (through dploot upgrade)#1151

Merged
NeffIsBack merged 2 commits intomainfrom
dpapi_chrome_fix
Mar 14, 2026
Merged

Fix #1139 : Add support for Google Chrome v137+ app bound key decryption (through dploot upgrade)#1151
NeffIsBack merged 2 commits intomainfrom
dpapi_chrome_fix

Conversation

@zblurx
Copy link
Collaborator

@zblurx zblurx commented Mar 13, 2026

Description

Add support for dploot 3.2.2 and google chrome +137 decryption : zblurx/dploot@7b4cd6b (this is the main commit, but I changed few things after)

Well explained : https://specterops.io/blog/2026/03/04/offensive-dpapi-with-nemesis/
TLDR : Google Chrome has (again) updated the way they are storing the secrets. Now App Bound Key requires a CNG stored key to be decrypted, in addition of the previous stuff (SYSTEM DPAPI and USER DPAPI). This PR adds CNG decryption support.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Install a fresh Google Chrome, save up some passwords in it, and try to decrypt them

Screenshots (if appropriate):

image

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@NeffIsBack
Copy link
Member

Nice one! Gonna review it on the weekend.

@NeffIsBack NeffIsBack added the enhancement New feature or request label Mar 13, 2026
Copy link
Member

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beautiful, works as expected:
Image

LGTM

@NeffIsBack NeffIsBack merged commit 75b207c into main Mar 14, 2026
15 checks passed
@NeffIsBack NeffIsBack deleted the dpapi_chrome_fix branch March 14, 2026 15:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants