> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# DPAPI Secret Extraction (dpapi)

> Extract SCCM secrets from DPAPI encrypted blobs on remote systems, including Network Access Account credentials and task sequence variables.

The `dpapi` module extracts SCCM-related secrets stored in DPAPI (Data Protection API) encrypted blobs on remote Windows systems. This technique recovers sensitive information including Network Access Account credentials, task sequence variables, and other SCCM secrets stored locally on client systems.

<Info>
  DPAPI secrets are stored both in the WMI repository and on disk in OBJECTS.DATA files. This module can extract from both locations, providing comprehensive secret recovery capabilities.
</Info>

## Attack Overview

The DPAPI extraction process works by:

1. **Remote Authentication**: Establishing connection with local administrator credentials
2. **Secret Location**: Identifying DPAPI blobs in WMI repository and/or disk storage
3. **DPAPI Decryption**: Using system privileges to decrypt the protected data
4. **Credential Extraction**: Parsing and extracting SCCM secrets from decrypted blobs

<Warning>
  This attack requires local administrator privileges on the target system. DPAPI secrets are machine-specific and can only be decrypted on the system where they were created.
</Warning>

## DPAPI Storage Locations

<Card title="SCCM Secret Storage Methods" icon="database">
  SCCM stores encrypted secrets in two primary locations:

  * **WMI Repository**: Active secrets stored in the WMI database (`-wmi` flag)
  * **Disk Storage**: Historical and cached secrets in OBJECTS.DATA files (`-disk` flag)
  * **Combined Approach**: Both locations for comprehensive extraction (`-both` flag)
</Card>

## Prerequisites

<Card title="Requirements" icon="checklist">
  * Valid local administrator credentials for the target system
  * Network connectivity to the target Windows machine
  * Target system running SCCM client with stored secrets
  * SMB/WMI access to the remote system (ports 135, 445)
</Card>

## Command Syntax

<CodeGroup>
  ```bash Command Format theme={null}
  python3 sccmhunter.py dpapi [OPTIONS]
  ```

  ```bash WMI Extraction theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -wmi
  ```

  ```bash Disk Extraction theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -disk
  ```

  ```bash Combined Extraction theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -both
  ```
</CodeGroup>

## Parameters

<Accordion title="Required Parameters">
  | Parameter | Description                   | Example                    |
  | --------- | ----------------------------- | -------------------------- |
  | `-u`      | Username for authentication   | `domainadmin`              |
  | `-target` | Target hostname or IP address | `workstation.ludus.domain` |
</Accordion>

<Accordion title="Authentication Options">
  | Parameter  | Description                         | Example                                             |
  | ---------- | ----------------------------------- | --------------------------------------------------- |
  | `-p`       | Password for authentication         | `password`                                          |
  | `-d`       | Target domain name                  | `ludus.domain`                                      |
  | `-dc-ip`   | Domain controller IP or FQDN        | `10.10.100.100`                                     |
  | `-hashes`  | NT:LM hash for authentication       | `aad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76` |
  | `-k`       | Use Kerberos authentication         |                                                     |
  | `-no-pass` | Don't prompt for password           |                                                     |
  | `-aesKey`  | AES key for Kerberos (128/256 bits) |                                                     |
</Accordion>

<Accordion title="Extraction Methods">
  | Parameter         | Description                     | Use Case                            |
  | ----------------- | ------------------------------- | ----------------------------------- |
  | `-wmi`            | Extract from WMI repository     | Active secrets currently in use     |
  | `-disk`           | Extract from OBJECTS.DATA files | Historical/cached secrets           |
  | `-both`           | Extract from both WMI and disk  | Comprehensive secret recovery       |
  | `-debug`          | Enable verbose logging          | Troubleshooting and detailed output |
  | `-impacket-debug` | Enable Impacket logging         | Network protocol debugging          |
</Accordion>

<Tip>
  Use `-both` for the most comprehensive extraction, as it combines both WMI and disk methods to recover all available SCCM secrets from the target system.
</Tip>

## Usage Examples

<Accordion title="WMI Repository Secret Extraction">
  **Extract active SCCM secrets from the WMI repository**

  ```bash theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -wmi
  ```

  **Expected Output:**

  ```
  [13:09:04] INFO     [*] Starting SCCM secrets extraction via WMI

  [13:09:04] INFO     [+] Found NAA credentials
  [13:09:05] INFO     [!] LSA hashes extraction failed: 'HashRecords'
  [13:09:05] INFO             - NetworkAccessUsername: ludus\sccm_naa
  [13:09:05] INFO             - NetworkAccessPassword: Password123
  [13:09:06] INFO     [+] Found Task Sequence
  [13:09:06] INFO             - Task Sequence: <sequence version="3.10"/>
  [13:09:06] INFO             - Task Sequence: <sequence version="3.10"/>
  [13:09:06] INFO             - Task Sequence: <sequence version="3.10"/>
  [13:09:06] INFO             - Task Sequence: <sequence version="3.10"/>

  [13:09:06] INFO     [*] WMI SCCM secrets dump complete
  ```

  <Info>
    WMI extraction recovers currently active Network Access Account credentials and task sequence variables stored in the WMI repository. This method is faster but may miss historical secrets.
  </Info>
</Accordion>

<Accordion title="Disk-Based Secret Extraction">
  **Extract secrets from OBJECTS.DATA files on disk for comprehensive recovery**

  ```bash theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -disk
  ```

  **Use Case:** This method accesses potentially changed or deleted secrets that may no longer be available in the WMI repository but are cached in disk storage.

  <Warning>
    Disk extraction may take longer as it processes OBJECTS.DATA files, but it can recover historical secrets that are no longer active in WMI.
  </Warning>
</Accordion>

<Accordion title="Comprehensive Extraction (Both Methods)">
  **Combine WMI and disk extraction for maximum secret recovery**

  ```bash theme={null}
  python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -both
  ```

  **Benefits:**

  * Recovers all active secrets from WMI repository
  * Extracts historical/cached secrets from disk storage
  * Provides the most complete picture of SCCM secrets on the target system
  * Identifies secrets that may have been rotated or updated

  <Tip>
    The combined approach is recommended for thorough assessments, as it ensures no SCCM secrets are missed during the extraction process.
  </Tip>
</Accordion>

## Understanding Extracted Secrets

<Card title="Types of SCCM Secrets Recovered" icon="key">
  The DPAPI extraction can reveal several categories of sensitive information:

  * **Network Access Account (NAA) Credentials**: Domain account used for content access
  * **Task Sequence Variables**: Custom variables containing passwords and configuration data
  * **Collection Variables**: Site-specific variables with embedded credentials
  * **Application Deployment Secrets**: Credentials used for software installation
  * **LSA Secrets**: Additional system-level credentials (when available)
</Card>

<CardGroup cols={2}>
  <Card title="WMI vs Disk Extraction" icon="compare">
    **WMI Repository:**

    * Currently active secrets
    * Faster extraction process
    * Real-time SCCM configuration
    * May miss historical data

    **Disk Storage (OBJECTS.DATA):**

    * Historical and cached secrets
    * Potentially deleted/rotated credentials
    * Comprehensive secret archive
    * Slower but more thorough
  </Card>

  <Card title="Operational Security" icon="shield-exclamation">
    **Detection Considerations:**

    * Requires local admin access (high privilege)
    * WMI queries may be logged
    * File system access creates audit trails
    * Network authentication generates logs
    * Consider timing and stealth requirements
  </Card>
</CardGroup>

## Target Selection Strategy

<Accordion title="Ideal Target Systems">
  **High-Value DPAPI Targets:**

  * **Workstations with frequent task sequences**: Systems that regularly receive OS deployments
  * **Administrative workstations**: Systems used by SCCM administrators
  * **Development/testing machines**: Often contain additional variables and secrets
  * **Systems with custom applications**: May have deployment-specific credentials
  * **Long-running systems**: More likely to have cached historical secrets

  **Target Identification:**

  * Use [`smb`](/enumeration/smb) profiling to identify SCCM clients
  * Target systems with recent SCCM activity
  * Focus on high-privilege user workstations
  * Consider systems in different site codes for broader coverage
</Accordion>

## Troubleshooting and Error Handling

<Accordion title="Common Issues and Solutions">
  **Authentication Failures:**

  * Verify local administrator privileges on target
  * Check network connectivity and firewall rules
  * Confirm WMI/SMB service availability

  **LSA Hashes Extraction Failed:**

  * Normal behavior in many environments
  * Focus on recovered NAA credentials and task sequences
  * Not critical for overall secret extraction success

  **No Secrets Found:**

  * Target may not be an active SCCM client
  * Try different extraction methods (-wmi, -disk, -both)
  * Verify SCCM client installation and configuration
</Accordion>

## Next Steps

<CardGroup cols={3}>
  <Card title="Credential Utilization" icon="arrow-right">
    **Use Extracted Secrets For:**

    * SMB share enumeration with NAA credentials
    * Lateral movement with discovered accounts
    * Additional SCCM infrastructure access
    * Privilege escalation opportunities
  </Card>

  <Card title="Persistence" icon="clock">
    **Maintain Access:**

    * Document all extracted credentials
    * Test credential validity across environment
    * Identify additional target systems
    * Establish persistent access methods
  </Card>

  <Card title="Coverage Expansion" icon="network-wired">
    **Broaden Assessment:**

    * Target multiple workstations for comprehensive coverage
    * Extract from different SCCM sites
    * Combine with other SCCMHunter modules
    * Build complete credential database
  </Card>
</CardGroup>

## Integration with Other Modules

<Card title="SCCMHunter Workflow Integration" icon="workflow">
  The DPAPI module complements other SCCMHunter capabilities:

  1. **Start with [`find`](/enumeration/find)**: Discover SCCM infrastructure
  2. **Profile with [`smb`](/enumeration/smb)**: Identify potential DPAPI targets
  3. **Extract credentials via [`http`](/exploitation/http)**: Get initial Network Access Account
  4. **Use DPAPI extraction**: Recover additional secrets from client systems
  5. **Escalate with [`mssql`](/exploitation/mssql)**: Leverage credentials for privilege escalation
</Card>