Masterkey decryption with backup key not working correctly

[leechristensen]

Ran the masterkeys command twice to compare the output from /rpc and /pvk. Note that the same masterkey GUID has two different values depending on if /rpc or /pvk was used:

[leechristensen]

Seems like the encrypted structure has changed. Changing this from an offset of 8 to 16 makes it work:

Buffer.BlockCopy(domainKeyBytesDec, 16, masterKey, 0, masterKeyLen);

[leechristensen]

Tentative solution: https://github.com/SpecterOps/Nemesis/blob/nemesis-2.1.3/libs/nemesis_dpapi/nemesis_dpapi/core.py#L341-L348