Comments on: Quickpost: Stored User Names and Passwords

By: Interesting Information Security Bits for 09/29/2008 « Infosec Ramblings

Interesting Information Security Bits for 09/29/2008 « Infosec Ramblings — Mon, 29 Sep 2008 20:41:49 +0000

[...] Quickpost: Stored User Names and Passwords Didier gives us some interesting info about where Windows keeps stored passwords. He also points us to some tools to work with them. [...]

By: Quickpost: SQL Server 2005 Management Studio and Password Management « Didier Stevens

Mon, 29 Sep 2008 16:08:55 +0000

[...] Filed under: Encryption, Quickpost, Reverse Engineering — Didier Stevens @ 16:06 Another stored password question I was asked: where does SQL Server 2005 Management Studio store the passwords, and are they [...]

By: Didier Stevens

Didier Stevens — Fri, 26 Sep 2008 21:49:53 +0000

No, when adding the first credentials, a file (credentials.sys) was create here:
C:\Documents and Settings\%Username%\Application Data\Microsoft\Credentials\%UserSID%\Credentials

And each time I added credentials, the file grew in size (128 bytes).
And decreased (128 bytes) when I removed a credential.

By: unary

unary — Fri, 26 Sep 2008 21:44:08 +0000

I tried with regmon/filemon to find where the credentials actually stored, still not sure:
hkcu\Software\Microsoft\Protected Storage System Provider,
\documents and settings\username\Application Data\Microsoft\Credentials or hklm\security? sam