Sunday, July 13, 2014

Java Hack to Scrape Passwords from GNOME Keyring & Chrome.

You already know I use linux most of the time and its pretty easy to tell I use Chrome too.   Well what you may not know is that I am also an Android user and flash custom roms from time to time.    Oh, and I also have lots passwords for various sites and things I use.

A few years ago, I started using UPM as a password manager on my phones & roms.    It is simple and works well for my needs.    I have always be able to back-up and restore UPM and its data, using Titanium Backup Pro.    However, this broke with my first foray installing an android 4.4.x rom on my Galaxy Note 2.   I lost all my passwords.    I had about 50 or 60.

Most of these passwords (and user names) were 'safe' as chrome has it own simplistic password manager that on linux is backed by the GNOME KeyRing.   I could simply create a new UPM data-base and copy and paste them from Chrome.  So I started, and then after about 3  C-n-P options I began to search for an export option as UPM supports a csv import.

Suitable, IMHO, export widgets for chrome don't exist; nor could I find one for seahorse or gnome key ring. So I thought I would build something on my own; how hard could it be?

Fast Forward and Skipping Details

Turns out it really isn't that hard, but locating needed ingredients and some simple instructions about GTK/Gnome hacking java is a bit time consuming.  After much effort I found this GITHUB project and a fork of that project, here.

With that later project I whittled up this:

package fhw;

import java.util.*;
import net.revelc.gnome.keyring.*; 

public class  UPMCSVDump
{
  public static void main(String[] args) throws GnomeKeyringException {
    GnomeKeyring gk = new GnomeKeyring("UPMCSVDump");
    String keyring = gk.getDefaultKeyring();
    Set ids = gk.getIds(keyring);
    String name;
    String userName;
    String userSecret;
    String url; 
    for(Integer id : ids)
    {
        GnomeKeyringItem gki = gk.getItem(keyring, id, true);
        //System.out.println(gki.toString(true));
        userName = null; 
        userSecret = null;
        name = null; 
        url = null; 
        //account name,user id,password,url,notes
        name = gki.getDisplayName();
        userSecret = gki.getSecret();
        for(GnomeKeyringItem.Attribute a : gki.getAttributes())
        {
            String s = a.getName();
            if("username_value".equalsIgnoreCase(s))
            {
                userName = a.getValue().toString();
            } 
            else if("action_url".equalsIgnoreCase(s))
            {
                url = a.getValue().toString();
            }
        }
        System.out.println(String.format("%s,%s,%s,%s,%s",name,userName,userSecret,url,""));
    }     
  }
}

No Magic Here

It is so simple, it is almost not worthy of sharing; but I did it in case some other poor soul winds up in the same situation.   Source and Gradle project can be found here:  https://github.com/fwelland/UPMCSVDump

2 TIPs

  1. Run this program on linux, logged in as the user whose key ring you need to extract.   Oh and you know, you should be in a gnome session that has already unlocked the key ring. 
  2. If you use UPM, maybe use its import/export features rather than relying on android backups and tools like Titanium.       

No comments:

Post a Comment