Module vault 

Windows Vault decoder (VAULT_VPOL policy + VAULT_VCRD records).

The Vault store (%APPDATA%\Microsoft\Vault\<GUID>\ and the %LOCALAPPDATA% counterpart) holds web/app credentials. Decryption is two-stage, following impacket 0.13.1 (impacket/dpapi.py + examples/dpapi.py, the VAULT action):

1. Policy — Policy.vpol is a VAULT_VPOL whose inner Blob is a DPAPI blob. Decrypting it with the user master key yields VAULT_VPOL_KEYS: two BCRYPT-wrapped AES keys (VaultVpolKeys). These keys are not per-record DPAPI blobs — they are the symmetric keys that decrypt the records.
2. Records — each <GUID>.vcrd is a VAULT_VCRD: a header, an attribute map, and per-attribute encrypted payloads. Each sizeable attribute carries an optional IV and AES-CBC ciphertext; AES-CBC-decrypting it with a VPOL key yields the cleartext, which for web credentials is a VAULT_INTERNET_EXPLORER schema (username / resource / password).

This module owns only the parsing + the AES-CBC record decrypt (RustCrypto aes/cbc, no hand-rolled crypto); the VPOL blob decrypt reuses crate::decrypt::decrypt_dpapi_blob. If the VPOL key cannot be derived (wrong master key), the policy decrypt errors loudly rather than guessing.

Structs

VaultVpolKeys

The two AES keys recovered from a decrypted VAULT_VPOL_KEYS blob.

VcrdAttribute

One VAULT_VCRD attribute’s encrypted payload.

WebCredential

A decoded web credential (VAULT_INTERNET_EXPLORER schema).

Functions

decrypt_vcrd_attribute

AES-CBC-decrypt one VCRD attribute with a VPOL key.

decrypt_vpol_keys

Decrypt the VPOL policy blob with the master key → the two AES keys.

parse_internet_explorer

Parse a decrypted VAULT_INTERNET_EXPLORER cleartext into a WebCredential.

parse_vcrd_attributes

Parse a VAULT_VCRD record into its encrypted attributes.

parse_vpol_file

Strip the VAULT_VPOL wrapper, returning the inner DPAPI blob bytes.