Harvesting Plaintext Passwords in Windows OS

🔒 Secure Bits 💡
𝗛𝗮𝗿𝘃𝗲𝘀𝘁𝗶𝗻𝗴 𝗣𝗹𝗮𝗶𝗻𝘁𝗲𝘅𝘁 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 𝗶𝗻 𝗪𝗶𝗻𝗱𝗼𝘄𝘀

Where are your secrets hiding?

You’d be surprised how often I can extract plaintext credentials during assessments — even in environments with Credential Guard enabled.

In this carousel, I’ll walk you through multiple real attack surfaces — and how to prevent them:

🔸 𝗠𝗦𝗧𝗦𝗖 (𝗥𝗲𝗺𝗼𝘁𝗲 𝗗𝗲𝘀𝗸𝘁𝗼𝗽 𝗖𝗹𝗶𝗲𝗻𝘁)
Even with Credential Guard, passwords can be extracted from the MSTSC process memory during RDP sessions.
🔐 Not protected by Credential Guard
🛡 Use PAW, Tiering, and smartcards (even those have caveats)

🔸 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗔𝗰𝗰𝗼𝘂𝗻𝘁𝘀
If services run under basic Active Directory account, the password can be dumped directly from registry using SYSTEM rights.
🛠 No configuration needed — default behavior
🛡 Use gMSA, VSA, or minimize privileges

🔸 𝗪𝗗𝗶𝗴𝗲𝘀𝘁
WDigest used to store plaintext passwords by default (pre-Win10). Still exploitable via registry tweak.
🛠 Enabled via registry: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential:1
🛡 Protected Users group or Credential Guard prevent this

🔸 𝗗𝗲𝗳𝗮𝘂𝗹𝘁 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗗𝗲𝗹𝗲𝗴𝗮𝘁𝗶𝗼𝗻
With “Allow delegating default credentials,” passwords are cached during initial logon for RDP SSO logins.
🛠 Enabled via GPO / registry: Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow delegeting default credentials
🛡 Avoid, or use Restricted Admin / Remote Credential Guard

🔸 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗠𝗮𝗻𝗮𝗴𝗲𝗿
Storing credentials in Windows Credential Manager can expose them to an adversary. For example mapped drives using alternate credentials leave those secrets in LSASS.
🛠 No special config — happens when user selects “Use different credentials”
🛡 Block for admins via GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow storage of passwords and credentials for network authentication

🔐 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗴𝗮𝘁𝗵𝗲𝗿𝗶𝗻𝗴 𝗶𝘀 𝗲𝗮𝘀𝘆 — 𝗱𝗼𝗻’𝘁 𝗺𝗮𝗸𝗲 𝗶𝘁 𝗲𝘃𝗲𝗻 𝗲𝗮𝘀𝗶𝗲𝗿

💬 Which of these still exists in your environment?

👉 Swipe through, check your systems, and let me know which surprised you most.