# dploot

dploot is a Python command-line tool that extracts and decrypts Windows DPAPI-protected secrets, such as saved credentials, vaults and certificates, reachable over SMB, WMI, WinRM, MSSQL or a local filesystem.

dploot is a Python rewrite of SharpDPAPI, itself a port of the DPAPI logic in Mimikatz, letting the same functionality run from a Python interpreter and from Linux rather than requiring native Windows tooling.

It retrieves and decrypts Windows DPAPI-protected secrets: master keys, saved credentials, vaults, RDP gateway files, certificates, browser secrets, CNG keys, Windows Authentication Manager tokens and MobaXterm data, for both individual users and machines. Targets can be reached over SMB, WMI, WinRM, MSSQL, a mounted local filesystem, or a Cobalt Strike beacon, with Kerberos authentication supported on several of these paths, so it works both as a domain administrator and as a non-domain administrator doing offline or remote triage.

Website: https://github.com/zblurx/dploot