Skip to content

Comments

Fix DPAPI credential lookup: add lowercase username for dploot compatibility #1113

Open
mverschu wants to merge 1 commit intoPennyw0rth:mainfrom
mverschu:fix/dpapi-username-case
Open

Fix DPAPI credential lookup: add lowercase username for dploot compatibility #1113
mverschu wants to merge 1 commit intoPennyw0rth:mainfrom
mverschu:fix/dpapi-username-case

Conversation

@mverschu
Copy link

@mverschu mverschu commented Feb 18, 2026

Description

Fixes DPAPI master key decryption when the username contains uppercase letters (e.g. Administrator).

dploot looks up credentials using user.lower() (e.g. "administrator"), but credentials were only stored under context.username (e.g. "Administrator"). Because Python dict lookups are case-sensitive, the credential lookup failed and master keys were not decrypted.

This change adds the lowercase username as an additional key in both plaintexts and nthashes so dploot can find the credentials regardless of casing.

No new dependencies.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions.
In particular:

  • Bug Fix: Run the DPAPI module against a Windows target using a username with uppercase letters (e.g. Administrator, DOMAIN\User). Before the fix, master keys for that user were not decrypted because the credential lookup failed. After the fix, credentials are found and master keys decrypt successfully.

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • New and existing e2e tests pass locally with my changes
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

…ibility

dploot looks up credentials with user.lower() (e.g. 'administrator'), but we
only stored them under context.username (e.g. 'Administrator'). Python dict
lookups are case-sensitive, so the credential wasn't found and master keys
were never decrypted.

Co-authored-by: Cursor <cursoragent@cursor.com>
@NeffIsBack
Copy link
Member

Thanks for the bug fix PR! I'll take a look at it soon.

@NeffIsBack NeffIsBack added the bug-fix This Pull Request fixes a bug label Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix This Pull Request fixes a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants