Note: The WiFi password extractor tool has been removed from our site due to reduced usage and to keep the site lean. Both tools are still available externally: Network Policy Password Tool and SIPE (Sync Internals Password Extractor).
On a managed Chromebook, network configurations are often a black box, pushed silently by an administrator. This write-up delves into two distinct forensic methods for extracting saved WiFi credentials from a ChromeOS device. These techniques rely not on a vulnerability, but on knowing where the operating system stores its data and how to interpret it. We’ll explore two primary sources: the user’s synced account data and the verbose network policy logs.
Method 1: The Sync Cache (chrome://sync-internals)
This method targets WiFi networks that a user has personally connected to, especially those using a simple pre-shared key (PSK) like a home network. When Chrome’s sync feature is enabled, it helpfully saves these network details to the user’s Google account for use across devices.
The internal page chrome://sync-internals provides a raw, unfiltered view into this synchronized data. While the information is obfuscated, it isn’t truly encrypted. We discovered that for WiFi configurations:
- The network’s name (SSID) is typically stored as a hex-encoded string.
- The password (passphrase) is stored as a base64-encoded string.
This is a classic case of security through obscurity. The data is not encrypted in a way that would require a private key to unlock; it is merely encoded. With the right decoders, the original text is easily revealed.
Our tool automates this process. It locates the correct JSON object within the sync data, finds the relevant keys (like SPECIFICS.wifi_configuration.passphrase), and applies the appropriate decoding function to reveal the credentials in plaintext.
Method 2: The Policy Log (chrome://net-export)
This second, more powerful method targets networks that were pushed to the device by a school or enterprise administrator via policy. These configurations often use more complex WPA-EAP authentication and are not stored in the user’s sync data.
The key is the chrome://net-export utility, a debugging tool that can capture an exhaustive log of all network events. By selecting the “Include raw bytes” option, we instruct ChromeOS to dump the full, unaltered content of network configurations into the log file.
The process becomes a digital treasure hunt:
Net Log JSON -> Event -> params.bytes (Base64) -> Decoded Policy JSON -> NetworkConfigurations[]The generated log file is a massive JSON document. Our script parses this file, looking for specific log entries that contain policy information. Within one of these entries is a parameter named bytes containing a large base64 string. Decoding this string reveals another JSON object. And within that object is the prize: an array named "NetworkConfigurations".
This array contains the full details for every policy-defined network, including the SSID, security type, and, if it’s a PSK network, the plaintext passphrase. For enterprise networks, it reveals the EAP configuration details, which are critical for understanding how the device authenticates.
Conclusion
These two methods highlight a core principle of digital forensics: data is often stored in more places than one might expect. The Sync Internals method leverages user convenience features, while the Network Policy Extractor takes advantage of verbose diagnostic logging. Neither method requires “hacking” the OS; they simply require knowing where to look and how to decode the information that the system makes available. Even on a locked-down device, the data is often right there, waiting to be read.
Back to Blog