DecryptAutoLogon
by martin9 - April 13, 2021 at 02:53 PM
#1
This tool can extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon. Was made to be used with Cobalt Strike's execute-assembly: execute assembly screen shot Compiled with .NET 3.0 (Windows Vista's default)+. Needs to be run as SYSTEM. Not just as a high intgrity process because the special registry keys need are only visible to SYSTEM and can only be decyrpted by SYSTEM.
Why?

In order to support Kiosk mode Windows needs to keep the user's password in a reversable format. This was being kept at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon under "DefaultUserName" and "DefaultPassword" . Autologon was updated to store the passwords in the LSA Secrets registry keys that are only visible to SYSTEM. keithga provided a binary that popped a Message but no source code or command line version.
How it works

Through pInvoke calls:

    LSAOpenPolicy()
    LsaRetrievePrivateData()


DecryptAutoLogon Hidden Content
You must register or login to view this content.
Reply
#2
awesome stuff, wow thanks
Reply
#3
Cool!
This might be useful to me at some point.
Reply
#4
(April 29, 2021 at 01:33 AM)Levitating Wrote: Cool!
This might be useful to me at some point.

At the moment when you will use cobaltstrike
Reply
#5
Can I just say that it's great that you provided a full description? Long, extensive, wordy. I love it. I know exactly what I'm getting and can move on if I don't need it.

From the bottom of my heart, I give thanks.

Thx.
Reply
#6
There is a compiled version on the same github page at the bottom, for people who can't be bothered to do anything themselves.
Reply
#7
awesome stuff stuff man will have to test this later
Reply
#8
nice share dude, thank you
Reply
#9
I hope it works for me mate
Reply
#10
Thanks for sharing this
This forum account is currently banned. Ban Length: Permanent (N/A).
Ban Reason: Spam
Reply
#11
nice share dude, thank you
Reply
#12
Thanks for sharing! :-)
Reply

 Users browsing this thread: 1 Guest(s)