Nemesis 2.2 Automates Windows DPAPI and Chromium Data Decryption
Summary
Nemesis 2.2 links Windows DPAPI keys and Chromium files to automate forward and retroactive decryption, including App-Bound Encryption data when the required key material is available. User credentials are not persistently stored.
Key points
- Nemesis 2.2 correlates DPAPI masterkeys and related files by host to decrypt linked data regardless of submission order.
- It can obtain system and user masterkeys from registry hives, submitted credential material, or LSASS dumps.
- For Chromium 137+, the decryption workflow includes the CNG-stored Chromekey1 used with App-Bound Encryption.
- The platform can scan files for DPAPI blobs and display carved data and decrypted content for analysis.
- User passwords, NTLM hashes, and credential keys are not stored persistently; without a domain backup key, they must be resubmitted to decrypt newly submitted user masterkeys.
- The described methods are file- and memory-based and do not cover TPM usage.
Article Details
- Event Type
- Security tool update
- Impact
- Nemesis 2.2 automates forward and retroactive decryption of Windows DPAPI data, including Chromium cookies and saved logins protected by App-Bound Encryption and CNG keys. The capabilities support security analysis and can also facilitate offensive credential access; the article describes no specific incident or victim.
People
Vendors
GoogleWhile things have gotten more complicated with Google Chromium’s App-Bound Encryption (ABE) approach, particularly with the Chromium 137+ update that introduced the Cryptography API: Next Generation (CNG) wrinkle, theSpecterOpsSpecterOps has touched on using DPAPI in specific use cases over the last several years, from Slack, to capturing custom entropy, and even how it factors into protections for certificates and CA private keys, but the
Products
ChromiumNemesis 2.2 enhances the automation of DPAPI decryption on Windows, facilitating both forward and retroactive decryption of system and user keys, including those protected by Chromium’s App-Bound Encryption.EdgeThe Chromium Local State file from the same Chromium install (Chrome, Edge, etc.)Google Chromemajorly change until Nemesis 1.0.0 (and then with my colleague Andrew Gomez’ cookie-monster project for Chrome v1.37+).Microsoft WindowsNemesis 2.2 enhances the automation of DPAPI decryption on Windows, facilitating both forward and retroactive decryption of system and user keys, including those protected by Chromium’s App-Bound Encryption.NemesisNemesis 2.2 enhances the automation of DPAPI decryption on Windows, facilitating both forward and retroactive decryption of system and user keys, including those protected by Chromium’s App-Bound Encryption.
Tools
chrome_v20_decryptionAlso shoutout to these awesome projects that helped work out the newest version of Chromium’s app-bound-encryption approach: chrome_v20_decryption, cookie-monster, and DIANA.cookie-monsterwe used for abuse didn’t majorly change until Nemesis 1.0.0 (and then with my colleague Andrew Gomez’ cookie-monster project for Chrome v1.37+).DIANAAlso shoutout to these awesome projects that helped work out the newest version of Chromium’s app-bound-encryption approach: chrome_v20_decryption, cookie-monster, and DIANA.DPAPIck3Shoutout to these awesome projects that we built on top of: pypykatz, Impacket, DPAPIck3.ImpacketShoutout to these awesome projects that we built on top of: pypykatz, Impacket, DPAPIck3.lsa-whispererMicrosoft refers to as a credential key (a.k.a., pre-key) which you can also retrieve from LSASS via lsa-whisperer via the msv1_0 GetCredentialKey or msv1_0 GetStrongCredentialKey (from a SYSTEM context on the host)MimikatzYou can also use the BackupKey Remote Protocol ([MS-BKRP]), famously implemented in Mimikatz, from a list system (from the target user’s context) to retrieve a user DPAPI masterkey:pypykatzShoutout to these awesome projects that we built on top of: pypykatz, Impacket, DPAPIck3.SharpDPAPIGetCredentialKey or msv1_0 GetStrongCredentialKey (from a SYSTEM context on the host) and used with SharpDPAPI: