{"id":4205,"date":"2020-02-25T19:52:21","date_gmt":"2020-02-25T19:52:21","guid":{"rendered":"https:\/\/miloserdov.org\/?p=4205"},"modified":"2020-02-25T19:52:21","modified_gmt":"2020-02-25T19:52:21","slug":"how-to-decrypt-stored-windows-passwords-using-mimikatz-and-dapa","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=4205","title":{"rendered":"How to decrypt stored Windows passwords using mimikatz and DAPA"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<p style=\"text-align: justify;\">\n\tIn the article &ldquo;<a href=\"https:\/\/miloserdov.org\/?p=4129\" rel=\"noopener noreferrer\" target=\"_blank\">How to hack a Windows password<\/a>&rdquo; we learned where and how Windows stores user OS login passwords, learned how to extract these passwords in the form of a hash, and learned how to brute-force the password. We also got acquainted with the <a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\" rel=\"noopener noreferrer\" target=\"_blank\">mimikatz<\/a> program, which we used to extract passwords in the current system, or from Windows registry files from another computer.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn this article, we will continue to get acquainted with Windows internals, namely how this operating system stores passwords of other applications. We will also continue to get acquainted with the capabilities of mimikatz.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow Windows stores passwords<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tIn addition to the user password for logging into Windows (which, incidentally, may not be set), other passwords are stored in the OS:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tCredential Manager\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tWindows Vault\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tIE browser passwords\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tPasswords for connecting to Wi-Fi networks\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tCertifications\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tVPN passwords\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tSSH keys\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tGoogle Chrome browser passwords\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tGoogle Talk, Skype, Dropbox, iCloud, Safari credentials\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAll these passwords are stored encrypted. To encrypt the listed passwords and credentials, DPAPI (the Data Protection Application Programming Interface) is used. For the end user, all processes of encryption and decryption of data are transparent, that is, they do not require any action on their part.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe user password is used to encrypt this data. More precisely, master keys are generated, with the help of which the data is encrypted and decrypted, and the user password is used to decrypt the master keys. One user can have many master keys. A mechanism is provided in case the user password is changed: in fact, hashes from all old passwords are stored and an attempt is made to decrypt the master key until a suitable hash is found.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThis is an important consequence: in the system for the current user it is possible to decrypt, for example, passwords from the Google Chrome web browser. But if you copy the file where the passwords of this browser are stored to another computer without the necessary master key, you will not be able to decrypt these passwords.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to encrypt and decrypt using DPAPI<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tAs mentioned just above, DPAPI is used to encrypt and decrypt data. DPAPI is quite simple not only for end users, but also for developers who want to use this encryption &ndash; there are two functions to encrypt and decrypt, they can be called from the application.\n<\/p>\n<p style=\"text-align: justify;\">\n\tBefore moving on to extracting passwords from web browsers and other passwords stored on Windows, let&#39;s take a closer look at DPAPI. Many good articles have already been written explaining how DPAPI works. I will not try to retell them, but simply provide links at the end of this article. Instead of going into the theoretical details of DPAPI, let&#39;s take a practical step: encrypt a string or file using DPAPI.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWe will perform all subsequent actions in the mimikatz program, so run it as described in <a href=\"https:\/\/miloserdov.org\/?p=4129\" rel=\"noopener noreferrer\" target=\"_blank\">this article<\/a>.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe <strong>dpapi<\/strong> module is used to work with DPAPI, the <strong>protect<\/strong> command is used to encrypt data. This command has one required option <strong>\/data<\/strong>, after which you need to specify the path to the file you want to encrypt, or a text string.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFor example, I want to encrypt the string &lsquo;Test string to encrypt&rsquo;:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::protect \/data:&quot;Test string to encrypt&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-protect.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4207\" height=\"787\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-protect.png\" width=\"1103\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-protect.png 1103w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-protect-1000x714.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-protect-768x548.png 768w\" sizes=\"(max-width: 1103px) 100vw, 1103px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tPay attention to the section &ldquo;<strong>Blob:<\/strong>&rdquo; &#8211; this is the encrypted data in binary form.\n<\/p>\n<p style=\"text-align: justify;\">\n\tInstead of displaying the encrypted data on the screen, they can be saved using the <strong>\/out<\/strong> option:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::protect \/data:&quot;Test string to encrypt&quot; \/out:crypted.txt<\/pre>\n<p style=\"text-align: justify;\">\n\tAs a result, the <strong>crypted.txt<\/strong> file will be created. This file contains encrypted data, namely the line &lsquo;Test string to encrypt&rsquo;.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs you can see, we do not need to think about master keys and passwords &ndash; the operating system does everything itself.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFor decryption, the <strong>blob<\/strong> function is used (blob is data encrypted by this method) from the same <strong>dpapi<\/strong> module. This function has one required option, it is <strong>\/in<\/strong>, after which you need to specify the data for decryption. To decrypt, you also need to specify the <strong>\/unprotect<\/strong> flag, otherwise information about blob (encrypted data) will only be shown without decryption:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::blob \/in:crypted.txt \/unprotect<\/pre>\n<p style=\"text-align: justify;\">\n\tYou can see the source line on the screen.\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4208\" height=\"467\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob.png\" width=\"1103\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob.png 1103w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-1000x423.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-768x325.png 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-1100x467.png 1100w\" sizes=\"(max-width: 1103px) 100vw, 1103px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you want the decrypted data to be saved to a file, then use the <strong>\/out<\/strong> option.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to decrypt DPAPI files on another computer<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tWhat happens if I transfer the crypted.txt file to another computer and try to decrypt it with the same command? Let&#39;s try:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-2.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4209\" height=\"463\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-2.png\" width=\"913\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-2.png 913w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-2-768x389.png 768w\" sizes=\"(max-width: 913px) 100vw, 913px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAnd on another computer, the decryption failed and an error was displayed:\n<\/p>\n<pre class=\"brush:plain;\">\r\n * using CryptUnprotectData API\r\nERROR kuhl_m_dpapi_unprotect_raw_or_blob ; NTE_BAD_KEY_STATE, needed Masterkey is: {ac45381a-d9db-4c68-b0e9-7410667c3984}<\/pre>\n<p style=\"text-align: justify;\">\n\tSo we need the Masterkey ac45381a-d9db-4c68-b0e9-7410667c3984.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe string ac45381a-d9db-4c68-b0e9-7410667c398 is the master key hash. It can be said that this is an identifier or fingerprint of a key. On the source computer, where the data was encrypted, their decryption is easy and easy. And attempts to decrypt this data without having a master key fail. That is, we need to specify the Masterkey from the first computer &ndash; and not just any Masterkey (each user can have many), namely the one with which the data is encrypted.\n<\/p>\n<p style=\"text-align: justify;\">\n\tI have already extracted the required Masterkey, so I will specify it using the <strong>\/masterkey<\/strong> option and run the decryption command on the other computer again:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::blob \/in:crypted.txt \/unprotect \/masterkey:5dccd3bea06a52d4355fa6b03421845c9fe96277db0d5af1a24eb3daefb14d6fc66b386a3a235a29327d0dc1f7ca990389644af173893d4cf3392b3950953dd8<\/pre>\n<p style=\"text-align: justify;\">\n\tThis time everything went well:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-3.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4210\" height=\"518\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-3.png\" width=\"915\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-3.png 915w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-blob-3-768x435.png 768w\" sizes=\"(max-width: 915px) 100vw, 915px\" \/><\/a>\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to find&nbsp;Windows Masterkeys<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tMimikatz has a function that extracts all master keys for the current user. But before moving on to it, let&#39;s &lsquo;feel&rsquo; the master keys themselves so that they are not something abstract for us.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn decrypted form, the master key example looks like this: <strong>5dccd3bea06a52d4355fa6b03421845c9fe96277db0d5af1a24eb3daefb14d6fc66b386a3a235a29327d0dc1f7ca990389644af173893d4cf3392b3950953dd8<\/strong>\n<\/p>\n<p style=\"text-align: justify;\">\n\tEncrypted master keys are stored in a folder of the form <strong>%appdata%\\Microsoft\\Protect\\{sid}\\*<\/strong>. In this designation:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>%appdata%<\/strong> means <strong>C:\\Users\\&lt;USER&gt;\\AppData\\Roaming<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>{sid}<\/strong> means user SID\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tIn CMD (<strong>Win+r<\/strong> &rarr; type <strong>cmd<\/strong>) you can see your SID with the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwmic useraccount where name=&quot;%USERNAME%&quot; get sid<\/pre>\n<p style=\"text-align: justify;\">\n\tThe previous command will not work in <a href=\"https:\/\/miloserdov.org\/?p=4107\" rel=\"noopener noreferrer\" target=\"_blank\">PowerShell<\/a>. The following commands will work in both CMD and PowerShell.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo find out your SID:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwhoami \/user<\/pre>\n<p style=\"text-align: justify;\">\n\tTo find out the SID of all users:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwmic useraccount get name,sid<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/windows-sid.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4218\" height=\"521\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/windows-sid.png\" width=\"612\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tEncrypted master key files on your hard drive:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/master-keys.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4217\" height=\"310\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/master-keys.png\" width=\"963\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/master-keys.png 963w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/master-keys-768x247.png 768w\" sizes=\"(max-width: 963px) 100vw, 963px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe <strong>dpapi::masterkey<\/strong> function can decrypt master keys. If you use this function only with the \/in option, after which you specify the path to the master key, then information about it will be displayed without decrypting it:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::masterkey \/in:&quot;%appdata%\\Microsoft\\Protect\\S-1-5-21-4099021954-1290662600-116018068-1001\\ac45381a-d9db-4c68-b0e9-7410667c3984&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4216\" height=\"607\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey.png\" width=\"1106\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey.png 1106w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-1000x549.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-768x421.png 768w\" sizes=\"(max-width: 1106px) 100vw, 1106px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tA little later, we will return to this function when we will decrypt the master key offline, i.e. on another computer, without the ability to start a session for the owner of the target master key.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn order to extract all the master keys of the current user at once, run the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsekurlsa::dpapi<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/sekurlsa-dpapi.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4215\" height=\"788\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/sekurlsa-dpapi.png\" width=\"1106\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/sekurlsa-dpapi.png 1106w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/sekurlsa-dpapi-1000x712.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/sekurlsa-dpapi-768x547.png 768w\" sizes=\"(max-width: 1106px) 100vw, 1106px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tMaster keys in this section:\n<\/p>\n<pre class=\"brush:plain;\">\r\nAuthentication Id : 0 ; 371163 (00000000:0005a9db)\r\nSession           : Interactive from 1\r\nUser Name         : MiAl\r\nDomain            : HACKWARE-MIAL\r\nLogon Server      : HACKWARE-MIAL\r\nLogon Time        : 25.02.2020 13:25:54\r\nSID               : S-1-5-21-4099021954-1290662600-116018068-1001\r\n         [00000000]\r\n         * GUID      :  {abd3abfe-f620-46e4-a5ee-8dc314ef4169}\r\n         * Time      :  25.02.2020 18:34:11\r\n         * MasterKey :  450e3e2609e394dfef60c90533a06ddd84dc9968965bd8579a3c40607704077e506c8d0738e6f42cfd934b3eb75eedc3c29fe7deb8dd0cf05ddb4deb653fcbff\r\n         * sha1(key) :  806d3a6453a45b9b4eb3e8edafc9dd4b12c0d494\r\n         [00000001]\r\n         * GUID      :  {ac45381a-d9db-4c68-b0e9-7410667c3984}\r\n         * Time      :  25.02.2020 18:26:00\r\n         * MasterKey :  5dccd3bea06a52d4355fa6b03421845c9fe96277db0d5af1a24eb3daefb14d6fc66b386a3a235a29327d0dc1f7ca990389644af173893d4cf3392b3950953dd8\r\n         * sha1(key) :  d5a7975eea70b6fe5eae3809ed3c7e9c864d1333<\/pre>\n<p style=\"text-align: justify;\">\n\tGUID is an identifier, the name of a master key file. MasterKey is the masterkey itself.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFor convenience, mimikatz stores a cache of extracted master keys. And not only stores and displays them, but also uses the necessary master key if it is needed for certain operations. To view the contents of the cache, run the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::cache<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-cache.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4214\" height=\"304\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-cache.png\" width=\"804\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-cache.png 804w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-cache-768x290.png 768w\" sizes=\"(max-width: 804px) 100vw, 804px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe extracted master keys, that is, the cache, can be saved for use on another machine or another time.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to save and use master keys<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tTo save the cache, use the <strong>\/save<\/strong> and <strong>\/file:FILE<\/strong> options:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::cache \/save \/file:cache.bin<\/pre>\n<p style=\"text-align: justify;\">\n\tIf you do not specify <strong>\/file<\/strong>, then by default the data will be saved to the <strong>mimikatz_dpapi_cache.ndr<\/strong> file.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo load the cache, use the <strong>\/load<\/strong> and <strong>\/file:FILE<\/strong> options:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::cache \/load \/file:cache.bin<\/pre>\n<h2 style=\"text-align: justify;\">\n\tCREDHIST<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThis file is located on the <strong>&quot;%appdata%\\Microsoft\\Protect\\CREDHIST&quot;<\/strong> path, only useful in non-domain context. This file:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tcontains: previous encrypted credentials of the user (SHA1 &amp; NTLM)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tis used to: decrypt masterkey\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tis protected by: the most recent user password SHA1 hash used by the user on the system\n\t<\/li>\n<li style=\"text-align: justify; margin-left: 40px;\">\n\t\teach entry is protected by the previous key, etc.\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tTo view the properties of this file, run the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::credhist \/in:&quot;%appdata%\\Microsoft\\Protect\\CREDHIST&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tOutput Example:\n<\/p>\n<pre class=\"brush:plain;\">\r\n**CREDHIST**\r\n  dwVersion : 00000001 - 1\r\n  guid      : {86cddf31-2b68-42fb-a6e6-28b628228fc8}\r\n  dwNextLen : 00000000 - 0<\/pre>\n<p style=\"text-align: justify;\">\n\tI tried to decrypt this file in mimikatz with the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::credhist \/in:&quot;Z:\\files\\CREDHIST&quot; &quot;\/password:qweqwe123&quot; \/sid:S-1-5-21-4099021954-1290662600-116018068-1003<\/pre>\n<p style=\"text-align: justify;\">\n\tbut I didn&rsquo;t succeed. If you know how to decrypt it, then write in the comments.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to extract all passwords from Google Chome<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tIn mimikatz, using the <strong>dpapi::chrome<\/strong> command, you can extract all the passwords of the current user. You need to specify the <strong>\/in<\/strong> option with the path to the file where the credentials are stored. This file is <strong>&quot;%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data&quot;<\/strong>. By the way, this file is an SQLite database in which all data except passwords (that is, the addresses of sites, for example) are stored in clear text. And passwords are encrypted using DPAPI. To decrypt, also specify the <strong>\/unprotect<\/strong> flag:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::chrome \/in:&quot;%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data&quot; \/unprotect<\/pre>\n<h2 style=\"text-align: justify;\">\n\tHow to extract all cookies from Google Chome<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tGoogle Chome stores cookies in the file <strong>&quot;%localappdata%\\Google\\Chrome\\User Data\\Default\\Cookies&quot;<\/strong>. As with site passwords, all data except cookie values are stored in clear text. To retrieve all cookie names and values, run the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::chrome \/in:&quot;%localappdata%\\Google\\Chrome\\User Data\\Default\\Cookies&quot; \/unprotect<\/pre>\n<h2 style=\"text-align: justify;\">\n\tHow to extract Wi-Fi passwords from Windows<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tIn Windows, Wi-Fi passwords can be extracted without mimikatz, an example of commands:\n<\/p>\n<pre class=\"brush:bash;\">\r\nnetsh wlan export profile interface=&quot;&lt;INTERFACE NAME&gt;&quot; key=clear folder=c:\\\r\nnetsh wlan export profile interface=&quot;*&quot; key=clear folder=c:\\<\/pre>\n<p style=\"text-align: justify;\">\n\tFor this method to work, a Wi-Fi card must be pluged.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe disadvantage of this method is that it does not work for a turned off computer from which you can copy files.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn mimikatz there are special <strong>dpapi::wifi<\/strong> and <strong>dpapi::wwan<\/strong> commands for extracting passwords, respectively, from saved Wi-Fi and WWAN connections.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWi-Fi passwords are stored in files of the form:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>C:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{interface guid}\\*.xml<\/strong>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAnd WWAN passwords in files of the form:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>C:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\{interface guid}\\*.xml<\/strong>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tYou need to start by getting the master keys. Since I execute commands on the local machine, I decrypt the master keys with the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsekurlsa::dpapi<\/pre>\n<p style=\"text-align: justify;\">\n\tI found on the local machine two network interfaces, each of which has one Wi-Fi connection profile:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tC:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{24FF5798-6078-4148-96B5-75191CCEA209}\\{0C67E040-68A8-42A4-B870-8B5AA5E4823B}.xml\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tC:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{C623DA26-72C0-4DD6-99B1-6E2C2D06E8C5}\\{A372AA08-55B8-4A66-A349-EAAB48580E0A}.xml\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tTo extract Wi-Fi passwords, I run the commands:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::wifi \/in:&quot;C:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{24FF5798-6078-4148-96B5-75191CCEA209}\\{0C67E040-68A8-42A4-B870-8B5AA5E4823B}.xml&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-2.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4212\" height=\"562\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-2.png\" width=\"1026\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-2.png 1026w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-2-1000x548.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-2-768x421.png 768w\" sizes=\"(max-width: 1026px) 100vw, 1026px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tPassword in the line &quot;<strong>Key Material:<\/strong>&quot;.\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::wifi \/in:&quot;C:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{C623DA26-72C0-4DD6-99B1-6E2C2D06E8C5}\\{A372AA08-55B8-4A66-A349-EAAB48580E0A}.xml&quot; \/unprotect<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4213\" height=\"577\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi.png\" width=\"1032\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi.png 1032w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-1000x559.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-wifi-768x429.png 768w\" sizes=\"(max-width: 1032px) 100vw, 1032px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf the masterkey is not in the mimikatz cache, you can explicitly specify it with the \/masterkey option.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to extract Google Chrome passwords from another computer<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\t1. To decrypt the <strong>&ldquo;%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data&rdquo;<\/strong> file, you need a Masterkey that encrypts the passwords in this file.\n<\/p>\n<p style=\"text-align: justify;\">\n\t2. To decrypt the master key, you will need a Windows user password to log into the system and an encrypted master key file, that is, <strong>%appdata%\\Microsoft\\Protect\\{sid}\\*<\/strong> files.\n<\/p>\n<p style=\"text-align: justify;\">\n\t3. To crack a Windows user password, you need an NTLM hash.\n<\/p>\n<p style=\"text-align: justify;\">\n\t4. To retrieve the NTLM hash, you need OR registry files <strong>C:\/Windows\/System32\/config\/SAM<\/strong> and <strong>C:\/Windows\/System32\/config\/SYSTEM<\/strong>, OR lsass.DMP dump. Moreover, it is preferable to use dump, since it is possible to extract the SHA1 hash from it and this hash can be used directly to decrypt the master key, bypassing the brute-force password. The methods for obtaining the NTLM hash are described in the article &ldquo;<a href=\"https:\/\/miloserdov.org\/?p=4129\" target=\"_blank\" rel=\"noopener noreferrer\">How to hack a Windows password<\/a>&rdquo;:\n<\/p>\n<pre class=\"brush:bash;\">\r\nlsadump::sam \/system:C:\\path\\to\\SYSTEM \/sam:C:\\path\\to\\SAM<\/pre>\n<p style=\"text-align: justify;\">\n\t5. Then, to get the Masterkey offline, you need to run a command of the form:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::masterkey \/in:&quot;path\\to\\encrypted\\masterkey&quot; &quot;\/password:target_user_password&quot; \/sid:target_user_SID<\/pre>\n<p style=\"text-align: justify;\">\n\tSID can be taken from the folder name to the encrypted master key.\n<\/p>\n<p style=\"text-align: justify;\">\n\tCommand example:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::masterkey \/in:&quot;Z:\\files\\1f89c852-1c9d-47f9-81f8-b18be7c11512&quot; &quot;\/password:qweqwe123&quot; \/sid:S-1-5-21-4099021954-1290662600-116018068-1003<\/pre>\n<p style=\"text-align: justify;\">\n\tIf successful, the following will be displayed at the end:\n<\/p>\n<pre class=\"brush:plain;\">\r\n[masterkey] with volatile cache: SID:S-1-5-21-4099021954-1290662600-116018068-1003;GUID:{1bd91e0f-25f3-49e9-a370-bc68d1f0d272};MD4:ca76a176340f0291e1cc8ea7277fc571;SHA1:886d0f341f3c29030ec855334a08e52868c06c69;\r\n  key : 89e43af0a178c2f1c7311c028dd75e2d2489fc78a3df92808094b1671785d6fd7f107ec562320bcaa8563be759abbf60bf70791107c5240cda2cfddcb003df19\r\n  sha1: b73d4d8cbbdafa960e49ca480559a4b530e65f05<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-2.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4211\" height=\"739\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-2.png\" width=\"1028\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-2.png 1028w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-2-1000x719.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/02\/dpapi-masterkey-2-768x552.png 768w\" sizes=\"(max-width: 1028px) 100vw, 1028px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe main line begins with <strong>key<\/strong> &ndash; this is the decrypted master key.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAlso, the master key will be cached.\n<\/p>\n<p style=\"text-align: justify;\">\n\t6. Finally, for offline decryption of Google Chrome browser passwords, execute a command of the form:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndpapi::chrome \/in:&quot;PATH\\TO\\Login Data&quot; \/unprotect \/masterkey:MASTERKEY<\/pre>\n<p style=\"text-align: justify;\">\n\tIf the master key is already in the cache, then you can skip the <strong>\/masterkey<\/strong> option.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tWhere Windows stores passwords<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tHere are the paths to files that are encrypted using DPAPI. If something is missing, then write in the comments with a link to the source.\n<\/p>\n<p style=\"text-align: justify;\">\n\tPivot table by mimikatz author (very hard to read): <a href=\"https:\/\/onedrive.live.com\/redir?resid=A352EBC5934F0254!3104&amp;authkey=!ACGFg7R-U5xkTh4&amp;ithint=file%2cxlsx\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/onedrive.live.com\/redir?resid=A352EBC5934F0254!3104&amp;authkey=!ACGFg7R-U5xkTh4&amp;ithint=file%2cxlsx<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tWi-Fi passwords are stored in files of the form:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tC:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\{interface guid}\\*.xml\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAnd WWAN passwords in files of the form:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tC:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\{interface guid}\\*.xml Xml\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tCookies Google Chrome in file:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t%localappdata%\\Google\\Chrome\\User Data\\Default\\Cookies\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tPasswords for websites in Google Chrome:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tHere, <strong>%localappdata%<\/strong> on most systems means &lsquo;<strong>C:\\Users\\&lt;USERNAME&gt;\\AppData\\Local<\/strong>&rsquo;.\n<\/p>\n<p style=\"text-align: justify;\">\n\tEncrypted master keys are stored in a folder of the form <strong>%appdata%\\Microsoft\\Protect\\{sid}\\*<\/strong>. In this notation:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>%appdata%<\/strong> means <strong>C:\\Users\\&lt;USERNAME&gt;\\AppData\\Roaming<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>{sid}<\/strong> means user SID\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tSystem master keys:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tc:\\Windows\\System32\\Microsoft\\Protect\\*\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tUser certificates:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t%APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t%APPDATA%\\Microsoft\\Crypto\\RSA\\&lt;SID&gt;\\\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tSystem certificates:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tHKLM:\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates\\*\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tC:\\Programdata\\Microsoft\\Crypto\\RSA\\MachineKeys\\\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tDropbox\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tHKCU\\SOFTWARE\\Dropbox\\ks\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tHKCU\\SOFTWARE\\Dropbox\\ks1\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t%APPDATA%\\Local\\Dropbox\\instance1\\config.dbx\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t%APPDATA%\\Local\\Dropbox\\instance_db\\instanse.dbx\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tRsa securid:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t%LOCALAPPDATA%\\RSA\\SecurIDStorage\n\t<\/li>\n<\/ul>\n<h2 style=\"text-align: justify;\">\n\tConclusion<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tLike the first article, far from all the possibilities of mimikatz are revealed in this one. You will find more information in the documentation on the modules and commands of this program: <a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki<\/a>, although not everything is documented yet. Even in the DPAPI module, we did not consider the following commands designed to extract passwords from Windows:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>capi<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>cng<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>cred<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>vault<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>ssh<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>rdg<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>ps<\/strong>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>luna<\/strong>\n\t<\/li>\n<\/ul>\n<h2 style=\"text-align: justify;\">\n\tList of references<br \/>\n<\/h2>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/www.harmj0y.net\/blog\/redteaming\/operational-guidance-for-offensive-user-dpapi-abuse\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/www.harmj0y.net\/blog\/redteaming\/operational-guidance-for-offensive-user-dpapi-abuse\/<\/a>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/ired.team\/offensive-security\/credential-access-and-credential-dumping\/reading-dpapi-encrypted-secrets-with-mimikatz-and-c++\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/ired.team\/offensive-security\/credential-access-and-credential-dumping\/reading-dpapi-encrypted-secrets-with-mimikatz-and-c++<\/a>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/www.synacktiv.com\/ressources\/univershell_2017_dpapi.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/www.synacktiv.com\/ressources\/univershell_2017_dpapi.pdf<\/a>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"http:\/\/2018.offzone.moscow\/getfile\/?bmFtZT0xMi0wMF9XaW5kb3dzX0RQQVBJX1Nla3JldGlraS5wZGYmSUQ9NDEy\" target=\"_blank\" rel=\"noopener noreferrer\">http:\/\/2018.offzone.moscow\/getfile\/?bmFtZT0xMi0wMF9XaW5kb3dzX0RQQVBJX1Nla3JldGlraS5wZGYmSUQ9NDEy<\/a>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\/howto-~-credential-manager-saved-credentials\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\/howto-~-credential-manager-saved-credentials<\/a>\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\/howto-~-decrypt-EFS-files\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/github.com\/gentilkiwi\/mimikatz\/wiki\/howto-~-decrypt-EFS-files<\/a>\n\t<\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>In the article &ldquo;How to hack a Windows password&rdquo; we learned where and how Windows stores user OS login passwords, learned how to extract these passwords in the form of a hash, and learned how to brute-force the password. We also got acquainted with the mimikatz program, which we used<a href=\"https:\/\/miloserdov.org\/?p=4205\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":4207,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[441,442,92,97,126,443,429,430,64,16],"class_list":["post-4205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-password-attacks","tag-cookies","tag-dpapi","tag-fast-password-recovery","tag-hacking","tag-hash","tag-masterkey","tag-mimikatz","tag-ntlm","tag-passwords","tag-windows"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4205"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4205"}],"version-history":[{"count":5,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4205\/revisions"}],"predecessor-version":[{"id":4223,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4205\/revisions\/4223"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/4207"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}