DPAPISnoop Tool Recovers Windows Credentials via CREDHIST Hash Extraction

Key Takeaways

• The open-source tool DPAPISnoop has been updated to extract CREDHIST entries, allowing for the offline cracking of historical Windows credentials.
• This enhancement enables security researchers and attackers to recover past passwords and analyze password patterns.
• The technique leverages a legitimate Windows feature, not a vulnerability, but demonstrates how filesystem access can lead to credential compromise.
• Two new Hashcat modes (15920 and 15930) have been introduced to support the cracking of these CREDHIST hashes.
• Defenders should focus on monitoring for unauthorized access to DPAPI-related files and enforcing robust password policies.

A significant update to the open-source DPAPISnoop tool now allows for the extraction of CREDHIST entries, a development that could profoundly impact how historical Windows credentials are recovered and analyzed offline. This enhancement offers new avenues for red teams and malicious actors to uncover past password patterns and potentially gain deeper access within compromised systems.

Lefteris Panos, a Security Consultant at LRQA Red Team, confirmed that the latest version of DPAPISnoop specifically integrates CREDHIST extraction capabilities. This functionality complements its existing ability to recover and analyze historical Windows credentials and DPAPI Master Key hashes.

Microsoft’s Data Protection API (DPAPI) is a foundational component within Windows, designed to safeguard sensitive user data. This includes a wide array of information such as browser credentials, private encryption keys, and other stored secrets.

Historically, both attackers and red team professionals have prioritized the recovery of DPAPI Master Keys, as these keys are essential for decrypting the data protected by DPAPI. However, the CREDHIST artifact, while less frequently exploited, plays a crucial role in the underlying architecture of DPAPI.

DPAPISnoop Tool Extracts CREDHIST Entries

Windows maintains a chain of previous password-derived keys when a user changes their password. This design ensures that older encrypted data remains accessible even after a password update. This credential history is stored in the CREDHIST file, typically found at %APPDATA%MicrosoftProtect.

Each entry within the CREDHIST file represents a prior password, encrypted using key material derived from that specific password. These entries form a sequential chain, detailing a user’s password evolution.

According to Lefteris Panos at LRQA Red Team, the updated DPAPISnoop tool can now parse these CREDHIST files and convert their entries into formats suitable for offline cracking. These unique hashes, identifiable by the “$credhist$” prefix, are compatible with Hashcat, a popular password cracking utility.

To facilitate this, researchers have introduced two new Hashcat modes:

• 15920: For CREDHIST entries encrypted using 3DES with HMAC-SHA1.
• 15930: For entries encrypted using AES-256 with SHA-512.

This allows security professionals or threat actors to brute-force historical password entries independently, eliminating the need to decrypt the entire DPAPI key chain upfront. Once these hashes are extracted, they can be cracked offline using GPU-accelerated tools like Hashcat. If a password is successfully recovered, it can then be fed back into DPAPISnoop to decrypt further entries in the credential chain.

For instance, cracking a CREDHIST entry from the middle of the chain can reveal the SHA1 or NTLM hash of an older password. This recovered hash can then be used to unlock subsequent entries, allowing for the comprehensive reconstruction of a user’s password history.

It’s important to note that older CREDHIST entries frequently employ weaker cryptographic schemes, such as SHA1-based PBKDF2 with 3DES. This makes them considerably easier to crack compared to more modern implementations that utilize SHA-512 with higher iteration counts.

While this behavior is not considered a vulnerability in itself, it underscores how legitimate Windows features can be exploited to obtain credentials once an attacker gains filesystem access. The ability to recover historical passwords provides invaluable intelligence, including:

• Identification of password reuse patterns across various systems.
• Insight into trends in password complexity over time.
• Potential for password reuse across different enterprise accounts.

Such intelligence can significantly accelerate lateral movement and privilege escalation in real-world attack scenarios.

Detection and Mitigation

Defenders must establish robust monitoring for unusual access patterns to DPAPI-related file paths, specifically:

• %APPDATA%MicrosoftProtectCREDHIST
• User-specific DPAPI directories
• Remote access attempts via SMB or administrative shares

Existing security solutions, including Sigma and Elastic, already offer detection rules designed to flag suspicious access to credential history files. The primary challenge lies in effectively distinguishing legitimate DPAPI activity from malicious file access patterns.

What You Should Do

• Enforce Strong Password Policies: Implement and enforce policies that mandate complex, unique passwords and regular password rotations.
• Limit Local File Access: Restrict user and process access to sensitive system files and directories, particularly those related to DPAPI and credential storage.
• Monitor Endpoint Activity: Deploy Endpoint Detection and Response (EDR) solutions to monitor for unusual credential-related behavior, including access to DPAPI and CREDHIST files.
• Implement Multi-Factor Authentication (MFA): Require MFA for all accounts to add an additional layer of security, even if a password is compromised.
• Regularly Audit Access: Conduct periodic audits of file system access logs and security events to identify and investigate anomalous activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.