[Noctem187]

How would I dump saved RDP creds once I have access to a machine?

I have tried dumping lssas service and have located the file but i don't get much.

[Sage]

My software in my signature grab the RDP creds saved on windows machine

[Mr. Robot]

My software in my signature grab the RDP creds saved on windows machine

https://gridinsoft.com/blogs/wise-remote...ansomware/
https://www.cyfirma.com/outofband/wise-r...s-arsenal/

[DramaKing]

There are credential stealers, but here's how you would do it. Saved RDP credentials are stored with Credential Manager (credman) in %localappdata%\Microsoft\Credentials using CryptProtectData (DPAPI).

[Noctem187]

There are credential stealers, but here's how you would do it. Saved RDP credentials are stored with Credential Manager (credman) in %localappdata%\Microsoft\Credentials using CryptProtectData (DPAPI).

Thank you, ill try this out.
I was looking for something not requiring tools, just the location then I can run it through hashcat.

[DramaKing]

Hashcat is a tool, and though DPAPI is not a hashing algorithm, it looks like you can use modes 15300, 15310, 15900, and 15910 that were included in builds later than 3/2022.