Skip to content

dpapi.py QoL improvements #2167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Aptimex wants to merge 3 commits into
base: master
Choose a base branch
from
+21 −11
Open

dpapi.py QoL improvements #2167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d5dd326
dpapi: support unprotect SHA1 keys
Aptimex Apr 3, 2026
cfa7597
dpapi: unprotect outfile option
Aptimex Apr 3, 2026
b0314e4
dpapi: support keys with and without 0x prefix
Aptimex Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 15 additions & 10 deletions examples/dpapi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,8 @@ def getDPAPI_SYSTEM(self,secretType, secret):
machineKey, userKey = secret.split('\n')
machineKey = machineKey.split(':')[1]
userKey = userKey.split(':')[1]
self.dpapiSystem['MachineKey'] = unhexlify(machineKey[2:])
self.dpapiSystem['UserKey'] = unhexlify(userKey[2:])
self.dpapiSystem['MachineKey'] = unhexlify(machineKey.removeprefix("0x"))
self.dpapiSystem['UserKey'] = unhexlify(userKey.removeprefix("0x"))

def getLSA(self):
localOperations = LocalOperations(self.options.system)
Expand Down Expand Up @@ -164,7 +164,7 @@ def run(self):
print('Decrypted key: 0x%s' % hexlify(decryptedKey).decode('latin-1'))
return
elif self.options.key and self.options.sid:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
key1, key2 = deriveKeysFromUserkey(self.options.sid, key)
decryptedKey = mk.decrypt(key1)
if decryptedKey:
Expand All @@ -177,7 +177,7 @@ def run(self):
print('Decrypted key: 0x%s' % hexlify(decryptedKey).decode('latin-1'))
return
elif self.options.key:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
decryptedKey = mk.decrypt(key)
if decryptedKey:
print('Decrypted key with key provided')
Expand Down Expand Up @@ -393,7 +393,7 @@ def run(self):
blob = DPAPI_BLOB(cred['Data'])

if self.options.key is not None:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
decrypted = blob.decrypt(key)
if decrypted is not None:
creds = CREDENTIAL_BLOB(decrypted)
Expand All @@ -413,7 +413,7 @@ def run(self):
blob = VAULT_VCRD(data)

if self.options.key is not None:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))

cleartext = None
for i, entry in enumerate(blob.attributesLen):
Expand Down Expand Up @@ -445,7 +445,7 @@ def run(self):
vpol.dump()

if self.options.key is not None:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
blob = vpol['Blob']
data = blob.decrypt(key)
if data is not None:
Expand All @@ -458,7 +458,7 @@ def run(self):
blob = DPAPI_BLOB(data)

if self.options.key is not None:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
if self.options.entropy_file is not None:
fp2 = open(self.options.entropy_file, 'rb')
entropy = fp2.read()
Expand All @@ -471,7 +471,11 @@ def run(self):
decrypted = blob.decrypt(key, entropy)
if decrypted is not None:
print('Successfully decrypted data')
hexdump(decrypted)
if self.options.outfile is not None:
with open(self.options.outfile, 'wb') as f:
f.write(decrypted)
else:
hexdump(decrypted)
return
else:
# Just print the data
Expand All @@ -488,7 +492,7 @@ def run(self):

# Handle key options
if self.options.key:
key = unhexlify(self.options.key[2:])
key = unhexlify(self.options.key.removeprefix("0x"))
keys = deriveKeysFromUserkey(chf.credhist_entries_list[0].sid, key)

# Only other option is using a password
Expand Down Expand Up @@ -602,6 +606,7 @@ def run(self):
unprotect.add_argument('-key', action='store', required=False, help='Key used for decryption')
unprotect.add_argument('-entropy', action='store', default=None, required=False, help='String with extra entropy needed for decryption')
unprotect.add_argument('-entropy-file', action='store', default=None, required=False, help='File with binary entropy contents (overwrites -entropy)')
unprotect.add_argument('-outfile', action='store', default=None, required=False, help='File to write decrypted data to (if not specified, it will be printed as hexdump)')

# A CREDHIST command
credhist = subparsers.add_parser('credhist', help='CREDHIST related functions')
Expand Down
7 changes: 6 additions & 1 deletion impacket/dpapi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -634,7 +634,12 @@ def fixparity(deskey):
return derivedKey

def decrypt(self, key, entropy = None):
keyHash = SHA1.new(key).digest()
if len(key) == 20:
# Key has already been hashed
keyHash = key
else:
keyHash = SHA1.new(key).digest()

sessionKey = HMAC.new(keyHash, self['Salt'], ALGORITHMS_DATA[self['HashAlgo']][1])
if entropy is not None:
sessionKey.update(entropy)
Expand Down