Native Windows Credential Extraction

[sempervictus]

Summary

Apparently, according to this wonderful tweet, mimikatz is effectively redundant with native windows functionality invoked by rundll32 keymgr.dll, KRShowKeyMgr

It would be great if we could leverage RG or native interfaces from meterpreters to get that data sans visual indicators.

[zeroSteiner]

Well according to the MSDN docs for KRShowKeyMgr the function:

Brings up the key manager dialog into the user interface.

That's great and all, but that doesn't really enable us to extract the actual values. I'm not sure, but maybe there's another key manager function that does allow that? That would make sense, but at that point I think we'd just be registering ourselves as a consumer of the natively-provided secret manager API.

[cn-kali-team]

This module does not work properly:
enum_cred_store

[sempervictus]

@zeroSteiner - i was hoping we could bind it to the calling "window" and use shell IO to extract creds in desktop 0 or some other "hidden away" area.

[sempervictus]

This module does not work properly: enum_cred_store

Need error logs, or debug statements added into the module's functions (you can use pry to do it on the fly or edit to actually modify the module source) - "not working properly" doesn't give us sufficient data from which to work a problem since we dont know what the problem actually is.