{"id":3987,"date":"2016-01-26T02:48:05","date_gmt":"2016-01-25T18:48:05","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3987"},"modified":"2017-10-29T20:19:05","modified_gmt":"2017-10-29T12:19:05","slug":"rwmc-retrieve-windows-credentials-powershell","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/01\/rwmc-retrieve-windows-credentials-powershell\/","title":{"rendered":"RWMC &#8211; Retrieve Windows Credentials With PowerShell"},"content":{"rendered":"<p>RWMC is a Windows PowerShell script written as a proof of concept to Retrieve Windows Credentials using only PowerShell and CDB command-line options (Windows Debuggers).<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/c2.staticflickr.com\/2\/1646\/24500426652_6547d7cd61.jpg\" alt=\"RWMC - Retrieve Windows Credentials With PowerShell\" \/><\/p>\n<p>It allows to retrieve credentials from Windows 2003 to 2012 and Windows 10 (It was tested on 2003, 2008r2, 2012, 2012r2 and Windows 7 &#8211; 32 and 64 bits, Windows 8 and Windows 10 Home edition).<\/p>\n<p>The script is different from <a href=\"https:\/\/www.darknet.org.uk\/2015\/07\/mimikatz-gather-windows-credentials\/\">Mimikatz<\/a> or <a href=\"https:\/\/www.darknet.org.uk\/2015\/02\/windows-credentials-editor-wce-list-add-change-logon-sessions\/\">WCE<\/a> because it doesn&#8217;t work with system .dlls to decrypt data. All the decryptions are made in the script.<\/p>\n<h3>Features<\/h3>\n<p>The main features of RWMC:<\/p>\n<ul>\n<li>Fully PowerShell<\/li>\n<li>Works locally, remotely or from a dump file collected on a machine<\/li>\n<li>Doesn&#8217;t use .dll files to locate credentials address in memory but a simple Microsoft debugger<\/li>\n<li>Doesn&#8217;t use OS .dll files to decipher passwords collected (AES, TripleDES, DES-X)<\/li>\n<li>Breaks undocumented Microsoft DES-X<\/li>\n<li>Works even if you are on a different architecture than the target<\/li>\n<li>Leaves no trace in memory<\/li>\n<\/ul>\n<h3>Requirements<\/h3>\n<p>To run this script effectively you need:<\/p>\n<ul>\n<li>PowerShell 3<\/li>\n<li>Allow PowerShell script on you machine, example : Set-ExecutionPolicy Unrestricted -force<\/li>\n<li>An Internet Connection<\/li>\n<\/ul>\n<p>You can download RWMC here:<\/p>\n<p><a href=\"https:\/\/github.com\/giMini\/RWMC\/archive\/master.zip\">RWMC-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/giMini\/RWMC\/tree\/master\/Reveal-MemoryCredentials\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>RWMC is a Windows PowerShell script written as a proof of concept to Retrieve Windows Credentials using only PowerShell and CDB command-line options (Windows Debuggers). It allows to retrieve credentials from Windows 2003 to 2012 and Windows 10 (It was tested on 2003, 2008r2, 2012, 2012r2 and Windows 7 &#8211; 32 and 64 bits, Windows [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"RWMC is a Windows PowerShell script written as a proof of concept to Retrieve Windows Credentials using only PowerShell and CDB command-line options.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9,31,4],"tags":[8857,492],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3987"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3987"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3987\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}