🆕 Dump DPAPI

You can dump Credential Manager secrets for the connecting user with the following option: --dpapi. No Admin privileges needed!

nxc winrm <ip> -u <USERNAME> -p <PASSWORD> --dpapi

Example

The Puppy machine on HackTheBox is a good example of this technique