the_open_door
coffee
ESEN
← Tools

SharpDPAPI

Decrypts DPAPI masterkeys, credentials and secrets (GhostPack, C#).

C# port of Mimikatz's DPAPI features (GhostPack): decrypts masterkeys, saved credentials, the Windows vault, cookies and DPAPI-protected secrets for the user or the machine.

Family Credential dumping & theft

Flags masterkeys credentials /unprotect /pvk

Concepts DPAPI Secrets

Cheatsheet Credentials & run-as

Installation

Useful commands2 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.