credhist

dpapi::credhist describes a Credhist file. Passcape mentions that CREDHIST is a password history file, made out as a chain, where each link represents the user's older password hashes (NT and SHA1). Each time user changes the password, the old password hash is appended to the file and encrypted with a new password. It has the following command line arguments:
/in: the path of the CREDHIST. According to this guide, it can be found at C:\users<UserName>\appdata\Roaming\Microsoft\Protect\CREDHIST
/sid: the Security Identifier of the target user
/sha1: the SHA1 hash of the target user password. It can be obtained through sekurlsa::logonpasswords.
/password: the password of the target user
mimikatz# dpapi::credhist in:"C:\users<UserName>\appdata\Roaming\Microsoft\Protect\CREDHIST"
During our test on a Windows 10 20H2 box, we could not find the CREDHIST file.
cred
luna
Last modified 1yr ago