Accessing Chrome Data On Mac Without Having to Enter Password

[nounouthereal]

Feature Description

I would like to know if it exists a way to access chrome data/masterkey using the executable on latest MacOS versions without having to enter the system password (avoid exit code 128)

Why is this feature needed?

Avoid interaction with the victim + Possibility to have a fully silent executable

Checklist

--Empty--

Screenshots/Videos

Additional Context

--Empty--

[nounouthereal]

.

[moonD4rk]

Your proposal is very good. I have also considered this issue, but as far as I know, it is impossible for ordinary users to access the macOS system's keychain without a password. It may only be possible by using some security vulnerabilities on the macOS system to gain root privileges.

[ZH3FENG]

I think we might find answer from chrome source code. How chrome access master key in keychain？

[ZH3FENG]

I got it, chrome is allowed to access the keychain item.
(https://developer.apple.com/documentation/security/keychain_services/access_control_lists)

[moonD4rk]

I got it, chrome is allowed to access the keychain item. (https://developer.apple.com/documentation/security/keychain_services/access_control_lists)

Yep! You can take a look at this project on Keybase. After the process writes an item to the keychain, it does not require a password to retrieve it. Chrome also uses a similar method.