Module credential 

Windows Credential Manager decoder.

On-disk credential files live at %APPDATA%\Microsoft\Credentials\<hex> and %LOCALAPPDATA%\Microsoft\Credentials\<hex>. Each file is impacket’s CredentialFile wrapper — Version(4), Size(4), Unknown(4), then a Size-byte Data blob that is a DPAPI blob. Decrypting that blob with the user master key yields a CREDENTIAL_BLOB carrying the target, username, and the secret (the stored password/credential), all UTF-16LE.

Layout and field semantics follow impacket 0.13.1 (impacket/dpapi.py, CredentialFile / CREDENTIAL_BLOB). This module owns only the parsing; the DPAPI decrypt reuses crate::decrypt::decrypt_dpapi_blob, and all crypto is the existing audited RustCrypto path — no hand-rolled primitives.

Structs

Credential

A decoded Credential Manager entry (impacket CREDENTIAL_BLOB).

Functions

decrypt_credential

Decrypt + decode a Credential Manager entry from its DPAPI blob bytes.

parse_credential_file

Strip the on-disk CredentialFile wrapper, returning the inner DPAPI blob.