2

A well known security-vulnerability in Windows (up until Windows 8.0) is that the WDigest password is stored in cleartext and can be extracted by using Mimikatz.

I found out that this password is in memory even if the user hasn't logged in yet (and hasn't typed his password once after rebooting).

Does anybody know why this password is already in memory after rebooting? I was thinking about certain processes that need to be started when booting, but I can't imagine that these processes would require a cleartext stored password.

4

This is to allow the user access when there is no domain controller. If you've ever turned off a domain joined computer, disconnected it from the domain, and turned it back on, you'd notice you can still log in with the domain account you usually use.

Regardless of whether you disable or enable WDigest, Windows will still store cleartext credentials for Kerberos authentication, so that it can renew tickets and stuff without you having to type the password every time. It's not necessarily a Windows issue, as it's the same for Linux and OS X.

Cleartext password dump for Linux: https://github.com/huntergregal/mimipenguin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.