6

What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)?

With a backup file from Credential Manager and the password used to created that backup file is it possible to decipher the file and read the stored credentials in plain text?

I have one password for a remote desktop that I forgot, but it is stored in the Credential Manager in my computer. I would like to read that password from my machine. Is there a way?

  • 2
    Not a bad question for pentest purposes. But for general "forgot password" purposes, you are probably better off just contacting the System Administrator for a reset or resetting it yourself locally with a boot disk. – Iszi Jul 8 '15 at 19:03
  • 2
    I am "the administrator" : P – PAC Jul 8 '15 at 19:08
  • @Iszi does the boot disk would work? At the original machine or the machine with password in credential manager? And would use brute force? – PAC Jul 8 '15 at 19:11
  • 1
    Unless the system drive itself is encrypted, there's a number of boot disks that will allow you to change local account passwords for a Windows system. This would have to be done locally on the target system, not on an RDP client. – Iszi Jul 8 '15 at 19:20
6

The Credential Manager stored passwords are managed by the Data Protection API and protected by DPAPI "master keys":

The DPAPI keys used for encrypting the user's RSA keys are stored under %APPDATA%\Microsoft\Protect{SID} directory, where {SID} is the Security Identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 64 bytes of random data.

This Synactiv presentation has a good overview of DPAPI master keys:

These masterkeys are stored in blobs, each containing:

  • a GUID
  • a salt
  • master key structure (containing master keys)

... and includes this chart, which shows how the protections have changed with each release of Windows:

chart of DPAPI algorithms by OS

According to that presentation, shared keys can be extracted with mimikatz. Beyond the Windows platform, the dpapick project also supports offline and non-Windows use of the API, and both that project and John the Ripper include DPAPImk2john.py, a script for extracting the masterkey files for cracking purposes. hashcat also supports cracking these DPAPI v1 and v2 masterkey files with that script.

So you should be able to use DPAmk2john.py to extract the master keys, and then crack them to access the credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.