+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Help] Has anyone ever programmatically accessed stored RDP windows credentials (/showthread.php?tid=6267732)
Has anyone ever programmatically accessed stored RDP windows credentials - CantPackCuba - Apr 5, 2024
Just wondering if this is even possible.
using AdysTech.CredentialManager Nuget Package i can retrieve username. Although the 2 values Password and SecurePassword seem to be blank
Code
static void Main(string[] args)
{
var credentials = CredentialManager.EnumerateCredentials();
foreach (var cred in credentials)
{
if (cred.UserName.Contains("Administrator"))
{
Debug.WriteLine(cred.UserName);
Debug.WriteLine(cred.Password);
Debug.WriteLine(GetSecureStringAsString(cred.SecurePassword));
}
}
Console.ReadLine();
}
static string GetSecureStringAsString(SecureString secureString)
{
if (secureString == null)
return string.Empty;
IntPtr ptr = IntPtr.Zero;
try
{
ptr = System.Runtime.InteropServices.Marshal.SecureStringToGlobalAllocUnicode(secureString);
return System.Runtime.InteropServices.Marshal.PtrToStringUni(ptr);
}
finally
{
System.Runtime.InteropServices.Marshal.ZeroFreeGlobalAllocUnicode(ptr);
}
}If this is possible it would make for a good stealer, Values such as ip/hostname could be found via registry :
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
RE: Has anyone ever programmatically accessed stored RDP windows credentials - SheldIO - Apr 6, 2024
The password is stored in an encrypted form. The encryption method is DPAPI. Use CryptUnprotectData to decrypt.
RE: Has anyone ever programmatically accessed stored RDP windows credentials - CantPackCuba - Apr 6, 2024
(Apr 6, 2024 03:31 AM)SheldIO Wrote: The password is stored in an encrypted form. The encryption method is DPAPI. Use CryptUnprotectData to decrypt.
I have tried :( I think there is more at play here.
The only stealers i have came across that achieve this idea are injecting into mstsc.exe
RE: Has anyone ever programmatically accessed stored RDP windows credentials - SheldIO - Apr 6, 2024
(Apr 6, 2024 09:53 AM)CantPackCuba Wrote: I have tried :( I think there is more at play here.
The only stealers i have came across that achieve this idea are injecting into mstsc.exe
https://github.com/twelvesec/passcat/blob/b446c982cf6e85fdbfedc8e953104e7302ceab01/passcat/libpasscat.cpp#L334
You're making it too complicated))
use windows credentials
RE: Has anyone ever programmatically accessed stored RDP windows credentials - CantPackCuba - Apr 7, 2024
(Apr 6, 2024 10:22 AM)SheldIO Wrote: https://github.com/twelvesec/passcat/blob/b446c982cf6e85fdbfedc8e953104e7302ceab01/passcat/libpasscat.cpp#L334
You're making it too complicated))
use windows credentials
Seems this only retrieves the generic credentials and not TERMSRV credentials, I will look through this project though thank you
edit : i changed this if statement in libpasscat::cat_credmanager_passwords from:
if (credentials[i]->UserName != NULL && (credentials[i]->Type == CRED_TYPE_GENERIC || credentials[i]->Type == CRED_TYPE_DOMAIN_VISIBLE_PASSWORD)) {
to:
if (credentials[i]->UserName != NULL || credentials[i]->Type == CRED_TYPE_DOMAIN_VISIBLE_PASSWORD) {
it now displays the TERMSRV credentials but does not seem to fetch a password. Probably because the project is from 2018
RE: Has anyone ever programmatically accessed stored RDP windows credentials - PulseLink - Apr 9, 2024
theres some metasploit modules that can be automated using db_nmap as well as wmap -sites and then scan for vulns on a whole subnet with wmap and db_nmap.
Then use the modules given to you by vulners etc to actually exploit them. It works well scanning popular hosting subnets.