live dpapi vpol command

Jump to bottom

skelsec edited this page Apr 14, 2021 · 1 revision

What it does

Decrypts a VPOL file using the current user's context.

Remarks

The VPOL file will not store secrets but decryption keys (usually two) for the matching VCRED file.
Decrypting the VCRED file is a separate command.

Requirements

The VPOL file

Subcommands

None

Switches

None

Examples

pypykatz live dpapi vpol VPOL: Decrypts the VPOL file.