DPAPI and DPAPI-NG: Decrypting All Users’ Secrets and PFX Passwords

on YouTube ↗52m

" summary

Claims a practical break: possession of the domain’s KDS root key or exported PFX private key lets an attacker decrypt every user DPAPI secret (Chrome cookies, KeePass DBs, exported PFX passwords) by recovering master key 2 and deriving keys. Demos use CQSecretsDumper, CQNTDSDTDecryptor, CQDPAPIBlobSearcher and CQDPAPIPFXDecryptor to extract the bootkey, KDS master, per-user master keys and decrypt blobs; the tools work live and offline and reveal that the AD certificate is effectively irreplaceable without major domain rebuild.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 3:36DPAPI in Windows security
3. 6:05System secrets and bootkey
4. 11:24Extracting hashes from SAM
5. 18:18User secrets vs domain users
6. 24:01Domain private key vulnerability
7. 33:08Decrypting user secrets
8. 41:59KeePass decryption risks
9. 46:27DPAPI-NG and KDS root key
10. 49:31Mitigating DPAPI risks
11. 50:54Q&A

" related talks

• 54mDPAPI and DPAPI-NG Decrypting All Users’ Secrets and PFX PasswordsP. Januskiewicz · Hack In Paris 2019
• 30mThe Windows Data Protection API (DPAPI)Claudio Contin · OWASP New Zealand Day 2024
• 01h 02mCQTools: The New Ultimate Hacking ToolkitPaula Januszkiewicz, Mike Jankowski-Lorek, Adrian Denkiewicz · Black Hat Asia 2019
• 54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against HackersPaula Januszkiewicz · Black Hat USA 2019
• 47mCunning With CNG: Soliciting Secrets From SchannelJake Kambic · Black Hat USA 2016
• 40mExploiting Windows Hello for BusinessMichael Grafnetter · Black Hat Europe 2019
• 21mBecome a hero to your DevSecOps teamNeal Michie · Droidcon London 2023
• 06mOur future without passwordsMaud Nalpas · dotJS 2024