DiscordHackTheBoxTryHackMeGitHub

DPAPI Secrets

ABOUT

DPAPI Secrets could be any data, as example browser creds, password manager data, vault creds.

Image from Synacktiv article below

LINUX

We'll be decrypting Secret with impacket's dpapi tool.

For decrypting DPAPI secret we need 3 things, and 2 of them are files which we need to install:

  1. Masterkey (filename is guid)

  2. DPAPI Secret

  3. SID of user encrypted (directory where Secret located)

  4. One of 5 things from scheme above, I'll use password for example.

Decrypting Secret

  1. Decrypting Masterkey with password's hash and SID

  1. Using decrypted Masterkey to decrypt Secret

WINDOWS

For Windows I only used SharpDPAPI for triaging certificates

SharpDPAPI

RESOURCES

LogoDPAPI secrets | The Hacker Recipeswww.thehacker.recipes
LogoWindows secrets extraction: a summarySynacktiv
LogoSharpCollection/NetFramework_4.0_Any/SharpDPAPI.exe at master · Flangvik/SharpCollectionGitHub
PreviousDCSyncNextMaking a Target List

Last updated