DPAPI and DPAPI-NG Decrypting All Users’ Secrets and PFX Passwords
summary
Claims two new, practical attacks: possession of a backup key LSA Secret on DC (the private key matching the domain backup public key) lets an attacker decrypt every domain user’s DPAPI master keys and therefore passwords, browser stores and private keys; and possession of KDS material plus a generated SID/token recovers KDS root key / SID-protected PFX passwords. Demonstrations use CQURE tools (CQ DPAPI blob searcher, CQ Secrets Dumper, NTDS decrypter, DPAPI-NG PFX decrypter), successfully export a DC PFX, rewrap master keys to a local hash and decrypt Chrome, KeePass and PFX files on Windows 8/8.1/10 and Server. Tools published on the team blog.
AI-written summary · about
chapters (9)
- 0:00Introduction to DPAPI
- 2:32Understanding secret storage
- 8:09Domain user data protection
- 14:26Cache logon data manipulation
- 22:27Extracting the domain key
- 28:42Privileged access mitigation
- 35:22System secret extraction
- 37:38DPAPI NG and PFX protection
- 46:31KeyPass decryption and summary
related talks
52mDPAPI and DPAPI-NG: Decrypting All Users’ Secrets and PFX Passwords
30mThe Windows Data Protection API (DPAPI)
01h 02mCQTools: The New Ultimate Hacking Toolkit
54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
47mCunning With CNG: Soliciting Secrets From Schannel
40mExploiting Windows Hello for Business
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
55mUnlocking The Secrets Of TLS