# 13 - Stored Credentials and the Windows Vault

#### Topics <a href="#topics" id="topics"></a>

> 1. Introduction to the Windows Shells
> 2. Windows Permissions
> 3. Reverse Shells in Windows
> 4. SeImpersonatePrivilege Exploitation
> 5. On Cross Compilation
> 6. Windows Services
> 7. Weak Service Permissions
> 8. Unquoted Service Path
> 9. DLL Hijacking
> 10. Always Install Elevated
> 11. Files with Sensitive Data
> 12. Windows Hashes
> 13. Stored Credentials and the Windows Vault
> 14. Scheduled Task
> 15. Critical Registry Paths
> 16. Useful Tools
> 17. AMSI Bypass

## **Credential Manager**

The **Credential Manager** is a Windows feature that provides centralized storage for user credentials such as usernames, passwords, and certificates. It simplifies authentication by securely storing credentials using the **Windows Data Protection API (DPAPI)**.

Credentials stored in the manager can be used by applications and services without requiring users to re-enter authentication details, improving convenience and productivity.

***

### **Why is it Dangerous?**

Even though credentials in the manager are encrypted using DPAPI, a compromised session exposes all stored credentials.

* **Active Use by Attackers**:\
  While plaintext passwords may not be accessible, attackers can leverage the stored credentials to authenticate to systems and services.

**Key Security Implication**:\
If a session is compromised, all credentials stored in the manager can be used.

#### **Best Practices**:

* Minimize the storage of sensitive credentials in your session.
* Protect your session with strong authentication and physical security.

***

## **Using Credential Manager**

**Accessing Credential Manager**

Navigate through:

```bash
Control Panel → User Accounts → Credential Manager → Web Credentials or Windows Credentials
```

***

**Command-Line Usage**

*   **List Stored Credentials**:

    ```bash
    cmdkey /list
    ```
*   **Add New Credentials**:

    ```bash
    cmdkey /add:MyServer /user:MyUser /pass:MyPassword
    ```
*   **Delete Credentials**:

    ```bash
    cmdkey /delete:MyServer
    cmdkey /delete:Domain:interactive=WORKGROUP\Administrator
    ```
*   **Run as Another User and Save Credentials**:

    ```bash
    runas /savecred /user:quickem-h5dsq1v\quickemu powershell.exe
    ```

    On subsequent uses, the password will not be requested:

    ```bash
    runas /savecred /user:quickem-h5dsq1v\quickemu "cmd.exe"
    ```

***

## **Windows Vault**

Credential Manager relies on the **Windows Vault** as its storage backend. The vault securely encrypts and manages sensitive data.

**Command-Line Access**

*   **List All Vaults**:

    ```bash
    vaultcmd /list
    ```
*   **List Entries in a Vault**:

    ```bash
    vaultcmd /listcreds:"Web Credentials" /all
    ```
*   **Dump Vault Data with Mimikatz**:

    ```bash
    bmimikatz.exe vault::list
    ```

***

## Other Resources

* **Credential Manager Store**:\
  [Microsoft Documentation](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994565\(v=ws.11\))
* **cmdkey Documentation**:\
  [Microsoft Documentation](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey)

{% hint style="danger" %}
**Disclaimer**

**❗ Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!**❗
{% endhint %}
