> For the complete documentation index, see [llms.txt](https://www.netexec.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.netexec.wiki/winrm-protocol/obtaining-credentials/dump-dpapi.md).

# Dump DPAPI

You can dump Credential Manager secrets for the connecting user with the following option: `--dpapi`. No Admin privileges needed!

```bash
nxc winrm <ip> -u user -p password --dpapi
```

### Example

The Puppy machine on HackTheBox is a good example of this technique

{% embed url="<https://www.hackthebox.com/machines/puppy>" %}