search

bitsadmin / fakelogonscreen

Fake Windows logon screen to steal passwords
BSD 3-Clause "New" or "Revised" License
1.29k stars 231 forks source link

Password comparison error #7

Open dh3b opened 2 years ago

dh3b commented 2 years ago

After running an exe the script compares the password wrongly.

I've tried writing my outlook password and PC numerical pin not non of these worked. Right after looking into %LOCALAPPDATA%\Microsoft\ there was no file like user.db. Is it a script bug or system stores the password not correctly?

bitsadmin commented 2 years ago

Hi dheb,

In case a PIN is configured you should have a password configured first. That is the password that is being requested at the fake logonscreen. Depending on whether the FakeLogonScreen.exe or FakeLogonScreenToFile.exe binary is used, the password is respectively printed to the console or written to a file. I haven't checked the source, but wrong attempts might also be written to that file.

I haven't tested what happens if a Microsoft account is used as opposed to a local or domain user account. I can imagine a Microsoft account underlying works with AzureAD and should then use the same Windows APIs to validate the password, but I haven't looked at that yet.

Hope this gives you some pointers to debug this!

Best, Arris