dpapi prekey command

What it does

Generates pre-keys which in turn will allow decryption of a masterkey file. This command can perform the key generation using either *password* + SID or *NT* hash + SID or via parsing the *registry* hive files, hence the three subcommand options

Remarks

There are three possible pre-keys generated for a given credential. Two out of the three keys can be generated without knowing the password only using the NT hash but it's not guaranteed that those two will always yield a successful decryption of a given masterkey.

Requirements

For You will need two things:

Credentials of the user. This credential can be the password or NT hash or secret key RC4/AES128/AES256
Have the SPN string of the service/user you wish to get the TGS for

Subcommands

password : This will take the user's SID (S-1-5-...) and password to generate all three prekey candidates
nt : This will take the user's NT hash and SID to generate two out of the possible three prekeys
registry : This will take registry hive files to yield the prekeys for the machine account (NT/SYSTEM user)

Switches

-o: Writes the TGS to file in KIRBI format

Examples

pypykatz dpapi prekey password 'S-1-5-21-3448413973-1765323015-1500960949-1105' 'Passw0rd!1': Generates three prekeys from the user's SID and password.
pypykatz dpapi prekey nt 'S-1-5-21-3448413973-1765323015-1500960949-1105' f8963568a1ec62a3161d9d6449baba93: Generates two out of the three possible prekeys using the user's SID and NT hash