WinPEAS fails to enumerate credentials

AliceGrey commented 3 years ago

When running the latest obfuscated winPEAS on a windows 10 vm I am unable to enumerate the credential manager. [X] Exception: Failed to enumerate credentials

I am however able to enumerate the credential manager manually with cmdkey /list

Currently stored credentials:

Target: MicrosoftAccount:target=SSO_POP_Device
Type: Generic 
User: 02ijxukxmordhvnv
Saved for this logon only

Target: WindowsLive:target=virtualapp/didlogical
Type: Generic 
User: 02ijxukxmordhvnv
Local machine persistence

Target: Domain:interactive=MSEDGEWIN10\admin
Type: Domain Password
User: MSEDGEWIN10\admin

This machine has credentials added to it using Tib3rius' windows priv-esc setup script (https://github.com/Tib3rius/Windows-PrivEsc-Setup)

carlospolop commented 3 years ago

Hi @AliceGrey, Thank you for reporting this bug! @makikvues could you take a look to it?

makikvues commented 3 years ago

hello @AliceGrey , thanks for reporting the bug. I was trying to reproduce it, but I couldn't. My testing environment is: Windows 10 Home, 10.0.19042 N/A Build 19042 Can you please tell us more info about yours? Thank you

makikvues commented 3 years ago

after some investigation I found that this issue is probably caused by missing visual c++ 2013 redistributable package (vcredist 2013) package - https://github.com/x360ce/x360ce/issues/330. to extract the credentials, we are using CredEnumerate win32 api. the error details I found were: Win32Exception: System.ComponentModel.Win32Exception (0x80004005): Element not found Looks like this may happen in a Windows VM. Unfortunately, currently we don't know a way around this issue, so we'll display a warning and ask the user to run "cmdkey /list" manually

peass-ng / PEASS-ng

WinPEAS fails to enumerate credentials #122