OFFENSIVE DPAPI WITH NEMESIS

Summary from the TLDR InfoSec newsletter

Nemesis 2.2 automates the full Windows DPAPI decryption chain, covering SYSTEM and user masterkeys, CNG keys, and Chromium's App-Bound Encryption introduced in Chrome 137+, which added a third decryption layer via the Google Chromekey1 CNG key stored in the Cryptography API Next Generation Key Storage Provider. The platform supports multiple credential input paths, including offline registry hives, LSASS dumps, NTLM hashes, and domain DPAPI backup keys, with the latter enabling persistent forward and retroactive decryption of all linked domain user masterkeys. Red teamers should note that submitting a domain backup key to Nemesis is the highest-leverage move, as it unlocks both existing and future masterkey blobs without requiring resubmission of per-user credentials.