How to reverse DPAPI-protected credentials

30 Jul 2019

How to reverse DPAPI-protected credentials

What is DPAPI?

The Data Protection Application Programming Interface is a simple crypto API used to store data in a secure way. It is used by multiple applications (such as web browsers like Chrome or the Credential Manager) to store credentials. It uses a MasterKey, which is a key derived from the user´s password and a BLOB object. If you want dig into the process of data protection check: https://docs.microsoft.com/en-us/previous-versions/ms995355(v%3Dmsdn.10)

These are all the functions the dpapi.h header has. But we will focus today on CryptProtectData and CryptUnprotectData, which are the most commonly used ones. First of all, we must check which credentials are stored. There are various ways to do this:

  1. 1)Via the Credential Manger

  1. 2)Via the cmdkey /list command or the vaultcmd /listcreds one.

  1. 3)Via Rundll: rundll32.exe keymgr.dll, KRShowKeyMgr

All these credentials have been encrypted with the CryptProtectData function of the DPAPI. There are various ways this can be useful during an engagement, for example, if there are interactive logon credentials we can just execute runas with the /savedcred flag and spawn any process with that user´s privileges.

We could invoke Get-WebCredentials method from Nishang if there were any web credentials stored (https://github.com/samratashok/nishang/blob/master/Gather/Get-WebCredentials.ps1)

Or even use the Windows Credential Manager dump module from peewpw (https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.ps1)

SharpDPAPI from GhostPack as well as SeatBelt are also very useful for this task,:

It is noticeable from the output of the SeatBelt executable that is telling us to use dpapi::cred

This is because mimikatz has a module specially designed for this, whose methods are:

  • dpapi::cred
  • dpapi::masterkey
  • dpapi::cache

And others

Of course we will need the masterkey to unprotect the stored credentials

So, hope you have understood what DPAPI is and what is used for, as well as how to abuse it. If you have any doubt or anything reach me out in the comments ;)

References:

-https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/

-https://docs.microsoft.com/en-us/previous-versions/ms995355(v%3Dmsdn.10)

-https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials

-https://github.com/GhostPack/SharpDPAPI

-https://github.com/GhostPack/Seatbelt