login-securite / DonPAPI

Dumping DPAPI credz remotely
GNU General Public License v3.0
941 stars 112 forks source link

Patching PVK decryption fuckup #19

Closed login-securite closed 2 years ago

login-securite commented 2 years ago

domain_master_key = DPAPI_DOMAIN_RSA_MASTER_KEY(decryptedKey) key = domain_master_key['buffer'][:domain_master_key['cbMasterKey']]

fucked up sometimes. didn't investigated enough to deaply understand why, this is just a hard patch to extract the key