Secrets / DPAPI / Registry / File Analysis

Back to the Command Index

This category covers analysis of offline hives, NTDS, and DPAPI files, as well as obtaining material through Remote Registry, DRS, and VSS. The boot key is the common starting point for SAM, LSA, and NTDS PEK. It cannot be calculated from .reg text.

DPAPI / SAM / LSA / NTDS
Packets / Registry / ESE / NTFS
DCE/RPC and NDR — rrp, drsuapi, bkrp, gkdi
Kerberos — Key List and keys inside tickets

Do not conflate acquisition methods (Remote Registry, VSS, DRSUAPI, WMI shadow, Key List) with decoders (SAMHashes, LSASecrets, NTDSHashes).

Command Index

Command	Summary
dpapi.py	Parses and decrypts DPAPI master keys, credentials, Vault data, CREDHIST, and more. Some operations obtain material from a remote host.
dpapidump.py	Obtains SYSTEM DPAPI credentials and SCCM client secrets from a remote host and decrypts them using the DPAPI_SYSTEM key.
esentutl.py	Reads catalogs, pages, and table rows from a local ESE/ESENT database.
ntfs-read.py	Opens an NTFS volume or image read-only to browse directories and extract files.
reg.py	Uses Remote Registry RPC to query, modify, and save registry data and back up SAM/SYSTEM/SECURITY hives.
registry-read.py	Opens a local registry hive read-only to inspect keys and values. Can also calculate the boot key from a SYSTEM hive.
regsecrets.py	Obtains SAM hashes and LSA secrets and cache data through Remote Registry. Does not cover NTDS.
samedit.py	Directly changes a user’s password hash in a local SAM hive using a SYSTEM hive or a specified boot key.
secretsdump.py	Extracts SAM, LSA, and NTDS hashes and Kerberos keys from local hives/NTDS files or a remote host.