Hello,
I’ve tried to decrypt some browser passwords from my old windows 7 laptop. With the help of mimikatz I had already success with some chrome passwords, but I don’t get the clue how to crack Internet Explorer. I took the blob structure from the registry (HKCU\Software\Microsoft/Internet Explorer/IntelliForms/Storage2) containing a Facebook password and typed the following in mimikatz:
dpapi::masterkey /in:C:\…\Protect\\ /password:
This is working fine so far, so the decrypted masterkey is stored in mimikatz’ cache. But as I try to decrypt the blob like this:
dpapi::blob /in:C:\path\to\file\with\value\from\registry /entropy:c0400e6fabb4c395ff857d0614e66508ba8ba737c5 /unprotect
…I get two errors:
ERROR kull_m_dpapi_unprotect_blob ; CryptDecrypt (0x80090005)
ERROR kuhl_m_dpapi_unprotect_raw_or_blob ; CryptUnprotectData (0x0000000d)
What did I miss? Thanks in advance!
John