search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.48k stars 3.74k forks source link

Fix naming of KULL_DPAPI_BLOB #422

Open poshul opened 1 year ago

poshul commented 1 year ago

the pbHmackKey member actually stores the AUX_INFO for the algorithm above. See the pvEncryptionAuxInfo section of https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-crypt_encrypt_message_para for details.

See this example where it stores the "salt" for an RC4 key: algCrypt : 00006801 - 26625 (CALG_RC4) dwAlgCryptLen : 00000028 - 40 dwSaltLen : 00000010 - 16 pbSalt : 7714b66f32c090777c36d5fbc7f123c3 dwHmacKeyLen : 0000000b - 11 pbHmackKey : 1dee397af8bf2f227d7940