1

dpapi securestring command

skelsec edited this page 2021-04-13 22:59:04 +02:00

Table of Contents

• What it does
• Remarks
• Requirements
• Subcommands
• Switches
• Examples

What it does

Decrypts a securestring file using the (already decrypted) masterkey file.

Remarks

None

Requirements

• Decrypted Mastekey file (I hope you haven't forgot to use -o)
• The securestring file or the hex string representing the securestring

Subcommands

None

Switches

None

Examples

• pypykatz dpapi securestring mkf.json securestring.dat: Decrypts the securestring file.

Home

• Wiki

Live commands

• lsa
• kerberos
  • currentluid
  • roast
  • tgt
  • apreq
  • purge
  • sessions
  • dump
  • triage
• smbapi
  • share
  • session
  • localgroup
• users
• token
• process
• dpapi
  • keys
  • vpol
  • vcred
  • cred
  • blob
  • blobfile
  • securestring
  • securestringfile
  • wifi
• smb
  • client
  • shareenum
  • lsassdump
  • regdump
  • dcsync
  • secretsdump
• ldap
  • client

Platform-independent commands

• lsa
  • minidump
• registry
• crypto
  • nt
  • lm
  • dcc
  • dcc2
  • gppass
• kerberos
  • tgt
  • tgs
  • brute
  • asreproast
  • spnroast (aka. kerberoast)
  • s4u
  • keytab
  • kirbi
  • ccache
    • list
    • del
    • roast
    • loadkirbi
    • exportkirbi
• dpapi
  • prekey
  • minidump
  • masterkey
  • blob
  • securestring
  • credential
  • vpol
  • vcred
• smb
  • client
  • lsassfile
  • lsassdump
  • regfile
  • regdump
  • dcsync
  • secretsdump
  • shareenum
• ldap
  • client

ConnectionURL

• ConnectionURL