Attacking Windows Credential Manager
Overview
Windows Credential Manager is a built-in feature (since Server 2008 R2 / Windows 7) that allows users and applications to securely store credentials for other systems and websites. Credentials are stored in encrypted folders protected by DPAPI.
Credential Storage Locations
| Path | Scope |
|---|---|
%UserProfile%\AppData\Local\Microsoft\Vault\ | User |
%UserProfile%\AppData\Local\Microsoft\Credentials\ | User |
%UserProfile%\AppData\Roaming\Microsoft\Vault\ | User |
%ProgramData%\Microsoft\Vault\ | System |
%SystemRoot%\System32\config\systemprofile\AppData\Roaming\Microsoft\Vault\ | System |
Each vault contains a Policy.vpol file with AES keys (AES-128/256) protected by DPAPI. Credential Guard (newer Windows) further protects DPAPI master keys using VBS (Virtualization-based Security).
Credential Types
| Type | Description |
|---|---|
| Web Credentials | Credentials for websites/online accounts (used by IE and legacy Edge) |
| Windows Credentials | Login tokens for services (OneDrive), domain users, network resources, shared directories |
Enumeration with cmdkey
List stored credentials for the current user:
cmdkey /list
Output fields:
| Field | Description |
|---|---|
| Target | Resource/account name (computer, domain, or identifier) |
| Type | Credential kind: Generic (general) or Domain Password (domain logon) |
| User | Associated user account |
| Persistence | Local machine persistence = survives reboots |
Impersonation with runas
When a Domain:interactive= credential is found, impersonate the stored user:
runas /savecred /user:DOMAIN\username cmd
Exporting Vaults
Export via GUI:
rundll32 keymgr.dll,KRShowKeyMgr
Exports are password-encrypted .crd files, importable on other Windows systems.
Credential Extraction with Mimikatz
Dump credentials from LSASS memory using the sekurlsa module:
mimikatz # privilege::debug
mimikatz # sekurlsa::credman
Alternative: manually decrypt using the dpapi module.
Related Tools
| Tool | Description |
|---|---|
| Mimikatz | Windows credential extraction and manipulation |
| SharpDPAPI | C# implementation for DPAPI attacks |
| LaZagne | Multi-platform credential recovery |
| DonPAPI | Remote DPAPI credential extraction |