Windows CardSpace - reading system credentials

Quick links - Selecting CardSpace data source > Reading system credentials - Decrypting system's Master Key - Decrypting user's Master Key - Decrypting InfoCard public data - Decrypting InfoCard PIN     - Selecting recovery method     - Setting attack options     - Launching selected attack - Decrypting InfoCard private data NPRW main page

Reading and decrypting system credentials

Any account in Windows, whether that's a user or the system, has the right to exist only when the corresponding passwords are set, even if those passwords are blank. System's accounts hide their passwords in Windows Secrets - a special storage for private information, inherited from the good old Windows NT.

In the automatic mode, the application reads that data automatically, without user's participation. In our case, we are to set the path to two registry files: SECURITY, which stores secrets (we are interested in just one secret that stores the password to the system account), and SYSTEM with the system data necessary for decrypting those. By default, registry files reside in the Windows folder; to be precise, in %WINDIR%\system32\config.
 

back to top