Dumping revelant information on compromised targets without AV detection 

Lots of credentials are protected by DPAPI.

We aim at locating those "secured" credentials, and retreive them using :

• User password
• Domaine DPAPI BackupKey
• Local machine DPAPI Key (protecting TaskScheduled blob)

• Windows credentials (Taskscheduled credentials & a lot more)
• Windows Vaults
• Windows RDP credentials
• AdConnect (still require a manual operation)
• Wifi key
• Intenet explorer Creentials
• Chrome cookies & credentials
• Firefox cookies & credentials
• VNC passwords
• mRemoteNG password (with default config)

• SMB signing status
• OS/Domain/Hostname/Ip of the audited scope

With local admin account on a host, we can :

• Gather machine protected DPAPI secrets
  • ScheduledTask that will contain cleartext login/password of the account configured to run the task
  • Wi-Fi passwords
• Extract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat)
• Identify who is connected from where, in order to identify admin's personal computers.
• Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG)
• Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant.

With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.

Dump all secrets of the target machine with an admin account :

DonPAPI.py domain/user:[email protected]

Using user's hash

DonPAPI.py --hashes <LM>:<NT> domain/[email protected]

Using kerberos (-k) and local auth (-local_auth)

DonPAPI.py -k domain/[email protected]DonPAPI.py -local_auth [email protected]

Using a user with LAPS password reading rights

DonPAPI.py -laps domain/user:[email protected]

It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys.

This credential file must have the following syntax:

user1:pass1  user2:pass2  ...