Dumping Information about DAPI Blobs from Powershell and .NET

This Script identifies the current master key GUID of the blob being encrypted by the system.

AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVHV+3dV0XEGGpdeIwr/L2wQAAAACAAAAAAADZgAAwAAAABAAAAC3Acu0kGl1ShI7AcSSNulJAAAAAASAAACgAAAAEAAAAAa0kmV05zGLZugZc0g+nKsQAAAAkkkbinmUcBiew391AqPh7hQAAAAfMziHP5hXYfx
OmmTywtVTS9cJGA== 01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F
C2 97 EB 01 00 00 00 54 75 7E DD D5 74 5C 41 86 A5 D7 88 C2 BF CB DB
04 00 00 00 02 00 00 00 00 00 03 66 00 00 C0 00 00 00 10 00 00 00 B7
01 CB B4 90 69 75 4A 12 3B 01 C4 92 36 E9 49 00 00 00 00 04 80 00 00
A0 00 00 00 10 00 00 00 06 B4 92 65 74 E7 31 8B 66 E8 19 73 48 3E 9C
AB 10 00 00 00 92 49 1B 8A 79 94 70 18 9E C3 7F 75 02 A3 E1 EE 14 00
00 00 1F 33 38 87 3F 98 57 61 FC 4E 9A 64 F2 C2 D5 53 4B D7 09 18
dwVersion: 01 00 00 00 guidProvider: DF 9D 8C D0 15 01 11 D1 7A 8C
00 C0 4F C2 97 EB dwMasterKeyVersion: 01 00 00 00 guidMasterKey: DD
7E 75 54 74 D5 41 5C 86 A5 D7 88 C2 BF CB DB dwFlags: 04 00 00 00
dwDescriptionLen: 02 00 00 00 szDescription: 00 00 algCrypt: 03 66
00 00 dwAlgCryptLen: C0 00 00 00 dwSaltLen: 10 00 00 00 pbSalt: B7
01 CB B4 90 69 75 4A 12 3B 01 C4 92 36 E9 49 dwHmacKeyLen: 00 00 00
00 pbHmackKey: 00 00 00 00 algHash: 04 80 00 00 dwAlgHashLen: A0 00
00 00 dwHmac2KeyLen: 10 00 00 00 pbHmack2Key: 06 B4 92 65 74 E7 31
8B 66 E8 19 73 48 3E 9C AB dwDataLen: 10 00 00 00 pbData: 92 49 1B
8A 79 94 70 18 9E C3 7F 75 02 A3 E1 EE 14 00 00 00 1F 33 38 87
dwSignLen: 3F 98 57 61 You cannot call a method on a null-valued
expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$
].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$
].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$
].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull You cannot call a method on a null-valued expression. At C:\mstsc\DPAPI.ps1:126 char:1
+ $pbSign = $pbSign + ” ” + $SecurePassword[$
].ToString(“X”).PadLeft(2 …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull pbSign: D7 09 18 Password123

PS Z:>

01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F C2 97 EB 01 00 00
00 54 75 7E DD D5 74 5C 41 86 A5 D7 88 C2 BF CB DB 04 00 00 00 02 00
00 00 00 00 03 66 00 00 C0 00 00 00 10 00 00 00 04 7B E6 E4 0C C0 38
D3 30 AE CC 09 7B 6F 4F 40 00 00 00 00 04 80 00 00 A0 00 00 00 10 00
00 00 CC DC 76 DA 56 55 94 22 E0 76 C8 B1 1D AC 9A B7 10 00 00 00 81
8A D4 42 39 14 2C 18 42 66 AC D1 AB FC 44 7A 14 00 00 00 50 E0 F0 2B
7D EC 99 47 B8 0E CD 5A 0A 25 AD A7 57 15 6E 9D

Plaintext: Password123

Encrypted:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVHV+3dV0XEGGpdeIwr/L2wQAAAACAAAAAAADZgAAwAAAABAAAAAEe+bkDMA40zCuzAl7b09AAAAAAASAAACgAAAAEAAAAMzcdtpWVZQi4HbIsR2smrcQAAAAgYrUQjkULBhCZqzRq/xEehQAAABQ4PArfeyZR7gOzVoKJa2nVxVunQ==

Decrypted: Password123 <<<>>>

Leave a comment

Your email address will not be published.