Извлечение секретов через Windows DPAPI

★ 8.4 · security

abusing-dpapi-for-credential-access is a Claude Code skill that guides authorized red-team operators through extracting and decrypting Windows DPAPI-protected secrets, including Credential Manager entries, browser saved logins and cookies (Chrome/Edge via SharpChrome), KeePass keys, Wi-Fi credentials, and certificate private keys. Three decryption paths are covered: online decryption in the target user's context using CryptUnprotectData, offline decryption with a plaintext password or NTLM hash, and estate-wide decryption via the domain DPAPI backup key obtained from a Domain Admin account. The skill maps to MITRE ATT&CK T1555.004 and T1555.003, provides ready-to-run SharpDPAPI, Mimikatz, and Impacket dpapi.py commands, and includes build instructions for GhostPack tooling. It is intended strictly for post-exploitation phases of authorized penetration tests and purple-team exercises with explicit written rules of engagement.