+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Dumping RDP creds on Windows machine (/showthread.php?tid=6246785)
Dumping RDP creds on Windows machine - Noctem187 - Jul 17, 2023
How would I dump saved RDP creds once I have access to a machine?
I have tried dumping lssas service and have located the file but i don't get much.
RE: Dumping RDP creds on Windows machine - Sage - Jul 17, 2023
My software in my signature grab the RDP creds saved on windows machine
RE: Dumping RDP creds on Windows machine - Mr. Robot - Jul 18, 2023
(Jul 17, 2023 07:37 AM)Sage Wrote: My software in my signature grab the RDP creds saved on windows machine
https://gridinsoft.com/blogs/wise-remote-trojan-infostealer-rat-ddos-bot-and-ransomware/
https://www.cyfirma.com/outofband/wise-remote-stealer-unleashed-unveiling-its-multifaceted-malicious-arsenal/
RE: Dumping RDP creds on Windows machine - DramaKing - Jul 18, 2023
There are credential stealers, but here's how you would do it. Saved RDP credentials are stored with Credential Manager (credman) in %localappdata%\Microsoft\Credentials using CryptProtectData (DPAPI).
RE: Dumping RDP creds on Windows machine - Noctem187 - Jul 18, 2023
(Jul 18, 2023 06:22 AM)DramaKing Wrote: There are credential stealers, but here's how you would do it. Saved RDP credentials are stored with Credential Manager (credman) in %localappdata%\Microsoft\Credentials using CryptProtectData (DPAPI).
Thank you, ill try this out.
I was looking for something not requiring tools, just the location then I can run it through hashcat.
RE: Dumping RDP creds on Windows machine - DramaKing - Jul 18, 2023
Hashcat is a tool, and though DPAPI is not a hashing algorithm, it looks like you can use modes 15300, 15310, 15900, and 15910 that were included in builds later than 3/2022.