live dpapi cred command

Jump to bottom

skelsec edited this page Apr 14, 2021 · 1 revision

What it does

Decrypts a credential file using the current user's context.

Remarks

It has the plaintext secrets, but it's not possible to tell in which filed they are stored. You'll need to check them by hand :)

Requirements

The credential file

Subcommands

None

Switches

None

Examples

pypykatz live dpapi cred CREDFILE: Decrypts the credentials file.