Announcing Incident Command! The AI powered Next-Gen SIEMLearn more.

module

Delinea Thycotic Secret Server Dump

Disclosed
Aug 15, 2022

Description

This module exports and decrypts Secret Server credentials to a CSV file;
it is intended as a post-exploitation module for Windows hosts with Delinea/Thycotic
Secret Server installed. Master Encryption Key (MEK) and associated IV values are
decrypted from encryption.config using a static key baked into the software. The
module also supports parameter recovery for encryption configs configured with
Windows DPAPI.
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.