Skip to content

Conversation

@Dramelac
Copy link
Member

Original PR on fortra/impacket: fortra#1137

This PR adds a new example, SystemDPAPIdump.py, which automates extraction of DPAPI credentials for the SYSTEM user on a remote host.

Currently it extracts and decrypts DPAPI credentials files (used by the task scheduler, amongst others) and SCCM client credentials (following @gentilkiwi's publication and implementation), using a combination of WMI (SCCM), SMB client (retrieve files) and remote registry (retrieve DPAPI keys) features from the library.

Process:

  • list and retrieve SCCM client secrets using WMI
  • list and retrieve DPAPI credential files from the SYSTEM user profile using SMB
  • parse retrieved credentials to obtain a list of masterkeys required for decryption
  • retrieve required masterkey files using SMB
  • dumps LSA Secrets to obtain dpapi_userkey (unless provided with -userkey, e.g. when previously obtained)
  • cleanup (end of remote operations)
  • decrypt masterkeys using dpapi_userkey
  • decrypt credentials/secrets using masterkeys

Has some error management to attempt cleanup even if something goes wrong, and tries to not perform unneeded operations.
Reuses code from secretsdump.py, wmiquery.py, dpapi.py, and smbclient.py.

@ShutdownRepo ShutdownRepo merged commit 1b688e5 into ThePorgs:main Jul 17, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants