The DPAPI is a Win­dows sys­tem which stored pass­words bound to the local system.

• In the user direc­to­ry there are the keys stored in the AppData\Roaming\Microsoft\Protect\<SID> directory.
• From the user’s pass­word, a mas­ter key is derived. When the user changes his pass­word, a new mas­ter key is gen­er­at­ed as well — and all old mas­ter keys are still in the direc­to­ry from above.
• Decrypt on the same sys­tem with Mimikatz.
• The script DPAPImk2john.py can be used to con­vert a DPAPI hash for John.

Links

• https://sudonull.com/post/6370-Secrets-DPAPI-or-DPAPI-for-pentesters