Impacket dpapidump.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Retrieves the SYSTEM account’s DPAPI credentials and SCCM client secrets from a remote host, then decrypts them with the DPAPI_SYSTEM key.
| Item | Details |
|---|---|
| Implementation | examples/dpapidump.py |
| Category | Secrets / DPAPI / registry / file analysis |
| Size | 507 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/dpapidump.py -h for the current option definitions.
| Argument | Description |
|---|---|
-creds | Extract SYSTEM user DPAPI credentials (default: all) |
-sccm | Extract SCCM client credentials (default: all) |
-userkey | DPAPI user key for SYSTEM, for example from a previous secretsdump run; if omitted, retrieve it by dumping LSA secrets |
target | [[domain/]username[:password]@] |
-ts | Add a timestamp to each log message |
-debug | Enable debug output |
-com-version | DCOM version in MAJOR_VERSION:MINOR_VERSION format, for example 5.7 |
-bootkey | Boot key for the SYSTEM hive |
-throttle | Delay in seconds between operations |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
-keytab | Read SPN keys from a keytab file |
-rpc-auth-level | RPC authentication level: default, integrity (RPC_C_AUTHN_LEVEL_PKT_INTEGRITY), or privacy (RPC_C_AUTHN_LEVEL_PKT_PRIVACY); for example, the CIM path “root/MSCluster” requires privacy by default (choices: integrity, privacy, default) |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
Detailed processing flow
Section titled “Detailed processing flow”The tool connects over SMB and obtains the boot key and DPAPI_SYSTEM through Remote Registry and LSA. It enumerates target directories and files or SCCM policy information through WMI, matches master key GUIDs to blobs, decrypts them, and displays the results. It applies throttling and restores remote service and connection state on exit.
How it works
Section titled “How it works”Reading SYSTEM DPAPI secrets from a remote host first requires the machine boot key
and the LSA secret DPAPI_SYSTEM. connect() creates an SMB session,
RemoteOperations prepares the required Remote Registry and LSA state, and
getDPAPI_SYSTEM() extracts machine and user DPAPI key material.
The credential path enumerates master key and credential files under the system
profile over SMB. Each DPAPI_BLOB has a master key GUID, so
decideBlobMasterkey() matches it to a retrieved master key. The machine key
decrypts that master key, which then decrypts the individual blob. Keeping the
steps separate avoids mistaking a GUID or cache mismatch for a simple padding error.
The SCCM path retrieves policy and secret information through DCOM/WMI and passes
DPAPI-protected portions through the same key hierarchy. Options determine which
of WMI, SMB, and Remote Registry are used. cleanup() restores remote service state,
removes temporary files, and closes DCOM connections; throttling controls repeated WMI/SMB requests.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
DumpCreds | 48 | __init__(), connect(), getDPAPI_SYSTEM(), getFileContent(), decryptBlob(), decideBlobMasterkey(), addPolicySecret(), dump(), cleanup() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.dcerpc.v5.dtypes | NULL |
impacket.dcerpc.v5.dcom | wmi |
impacket.dcerpc.v5.dcomrt | COMVERSION, DCOMConnection |
impacket.dcerpc.v5.dcom.wmi | DCERPCSessionError |
impacket.dcerpc.v5.rpcrt | RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY |
impacket.smbconnection | SMBConnection |
impacket.dpapi | CREDENTIAL_BLOB, CredentialFile, DPAPI_BLOB, MasterKey, MasterKeyFile |
impacket.uuid | bin_to_string |
impacket.examples.regsecrets | LSASecrets, RemoteOperations |
impacket.krb5.keytab | Keytab |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
- Cleanup-related methods include
cleanup(). Check that new early returns and exception paths reach it too.
When changing the implementation
Section titled “When changing the implementation”The code depends on SMBConnection, examples.regsecrets, impacket.dpapi, DCOM/WMI, and RPC authentication levels. DumpCreds.dump() collects data; decideBlobMasterkey() and decryptBlob() choose keys and decrypt blobs.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/dpapidump.py - CLI:
python examples/dpapidump.py -h - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/SMB_RPC/test_wmi.py - Related test:
tests/dcerpc/test_dcomrt.py - Related test:
tests/misc/test_dpapi.py