dpapi credential command

What it does

Decrypts a credential file using the (already decrypted) masterkey file.

Remarks

1. standalone file, inside it there is a DPAPI_BLOB.
2. DPAPI_BLOB can be decrypted with the corresponding masterkey
3. After decryption you'll find a CREDENTIAL_BLOB strucutre.
4. CREDENTIAL_BLOB strucutre has the plaintext secrets, but it's not possible to tell in which filed they are stored. You'll need to check them by hand :)

Requirements

• Decrypted Mastekey file (I hope you haven't forgot to use -o)
• The credential file

Subcommands

None

Switches

None

Examples

• pypykatz dpapi credential mkf.json cred: Decrypts the credentials file.