An application I am looking to use is using DPAPI to encrypt a Client Secret as part of a OAuth2 Authentication flow. A domain service account will be used for encryption with the password stored in CyberArk.

I am trying to understand how someone can decrypt the Client Secret. Based on research I've done a malicious actor will need to get the password for the service account and then use a 3rd party tool (such as DataProtectionDecryptor by NirSoft) to decrypt the Client Secret.

Is my understanding correct? Does DPAPI become useless once the password to the service account in this instance is known?


Well if you are able to login as the service you can call the DPAPI so if you have the password its not great.

If you can have code execute in the context of the account as well through say an injection flaw you can also decrypt using it.

Powershell has the ability to call [Security.Cryptography.ProtectedData]::Unprotect for example which under the account context will give you the secret.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.