SharpDPAPI

SharpDPAPI is a C# port of Mimikatz's DPAPI functionality for triaging Windows Data Protection API secrets. The masterkeys command decrypts the current user's DPAPI master keys (with /password: for their plaintext, or /pvk: with the domain backup key), writing a {GUID}:SHA1 lookup file. The credentials command then uses that /mkfile: to decrypt the user's Credential Manager blobs to plaintext. Run it from the user's own context or an elevated shell; it avoids dropping Mimikatz on disk. Command Reference: Password: password123 Masterkey file: masterkeys.txt

# Decrypt the user's DPAPI masterkeys
SharpDPAPI.exe masterkeys /password:password123

# Decrypt Credential Manager blobs with the recovered masterkeys
SharpDPAPI.exe credentials /mkfile:masterkeys.txt

Evidence

Upstream reference

Environment

Active Directory

Native

Credential Access

MITRE

T1555.004

Requires

Shell, Password

Services

NTLM

Refs

github.com/GhostPack/SharpDPAPI

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords

attack.mitre.org/techniques/T1555/004/