Dumping user credentials in clear text via DPAPI

Let us go through a scenario. Following internal security policies and after security awareness training, users started using Credential Manager in Windows instead of password.txt files. Credential Manager is a built-in password manager in Windows that uses the Data Protection API (DPAPI). DPAPI allows programs, such as Chrome or RDP, to store sensitive data transparently. This data is stored in a user’s directory and is encrypted by a key that is derived from the user’s password. Our target user, khal.drogo, had credentials in their Credential Manager for SQL system administrator (SA) account. An adversary has compromised the user with domain admin privileges and intends to pull the sa password in clear text. There are three attack scenarios:

• Obtain khal.drogo’s master key and then decrypt
• Extract all local master keys if you have local administrator privileges
• Extract all backup master keys with...