New DPAPISnoop Tool Enables Extraction of CREDHIST Hashes From Windows Systems

A newly enhanced version of the open-source DPAPISnoop tool is drawing attention in the security community after researchers demonstrated its ability to extract offline-crackable hashes from Windows DPAPI credential history (CREDHIST) files, potentially exposing historical password material and enabling deeper insight into user password patterns over time.

New DPAPISnoop Tool

Developed by Nettitude’s CyberLabs team, the updated DPAPISnoop now supports parsing and extracting CREDHIST entries, an often-overlooked artifact within the Windows Data Protection API (DPAPI) ecosystem.

DPAPI is widely used to secure sensitive user data such as browser credentials, encryption keys, and stored secrets, typically relying on user passwords to derive encryption keys.

While most offensive tooling focuses on recovering DPAPI Master Keys to decrypt protected data, this update shifts attention toward credential history chains maintained by Windows when users change their passwords.

CREDHIST files, located under %APPDATA%\Microsoft\Protect, store a sequential chain of encrypted historical password material. Each entry is protected using key material derived from a specific password in the user’s history, with newer entries tied to the current password and older entries chained backward.

By extracting these entries into structured hash formats, DPAPISnoop enables attackers or red team operators to perform offline cracking with tools like Hashcat, effectively recovering previously used passwords or password-derived material, such as NTLM and SHA1 hashes.

The research highlights that modern systems typically use AES-256 encryption combined with SHA-512-based PBKDF2 with approximately 8,000 iterations, which aligns with current DPAPI protections.

However, older entries within the CREDHIST chain may rely on weaker cryptographic schemes such as 3DES with HMAC-SHA1, making them significantly easier to crack.

This creates a practical attack path where weaker legacy entries can be targeted first, potentially allowing attackers to traverse the credential chain and recover newer passwords.

To support this workflow, the researchers also introduced two new Hashcat modes: 15920 for 3DES + HMAC-SHA1 CREDHIST entries and 15930 for AES-256 + SHA-512 entries.

Once a password is recovered, it can be reintroduced into DPAPISnoop to decrypt additional entries in the chain, effectively “walking” through a user’s password history.

This iterative process not only aids in credential recovery but also provides valuable password intelligence, revealing patterns such as reuse, incremental changes, or predictable structures.

Importantly, this technique does not exploit a software vulnerability but instead leverages intended DPAPI functionality. As such, the risk arises when attackers gain filesystem access to user profiles or DPAPI directories.

Security teams are advised to monitor abnormal access patterns to sensitive paths such as \Microsoft\Protect\CREDHIST and user SID-specific DPAPI directories, particularly over SMB or administrative shares.

Existing detection rules from SigmaHQ and Elastic already flag suspicious access to these files. However, analysts must refine signals to distinguish malicious activity from legitimate DPAPI usage.

The release of DPAPISnoop’s new capabilities underscores the evolving sophistication of credential access techniques. It highlights the importance of protecting endpoint data, enforcing strong password policies, and monitoring subtle indicators of compromise within Windows environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.