顶下，有人帮忙吗？

Location of Credential Store
Windows 'Credential Store' keeps the user credentials in the encrypted format at user specific locations. The storage mechanism is slightly different for XP and Vista/Win7 platforms.

For Windows XP
On Windows XP, the encrypted user credentials are stored in the hidden file called 'Credentials' inside both APPDATA and LOCALAPPDATA locations mentioned below.
APPDATA Location - C:\Documents and Settings\<username>\Application Data\Microsoft\Credentials\<user sid>\

LOCALAPPDATA Location - C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Credentials\<user sid>\

For Vista & Windows 7
Vista onwards, the user credentials are stored in the multiple files with random name (generated using GUID) inside both APPDATA and LOCALAPPDATA locations mentioned below. (There will be separate credential file for each of the network accounts)
APPDATA Location - C:\Users\<username>\AppData\Roaming\Microsoft\Credentials\

LOCALAPPDATA Location - C:\Users\<username>\AppData\Local\Microsoft\Credentials\

Based on type of password and application, one of these locations are chosen to store the corresponding credential file. For example, Windows Live Messenger & Remote Desktop login passwords are stored at LOCALAPPDATA location and all other type of passwords are stored at APPDATA location.

自己顶，慢慢在网上找资料。
找到一篇讲解原理的英文文档。
《Exposing the Secret of Decrypting Network Passwords》
http://securityxploded.com/networkpasswordsecrets.php

原理基本清楚了，对于Domain Network Passwords，只能被lsass.exe加解密，
所以
1、CreateRemoteThread 远程线程注入lsass
2、使用未公开的LsaICryptUnprotectData 来解密credentials buffer

哈哈，俺其实已经把工具弄出来了！ 楼主想用这个来抓xx的密码吧？

给你透露点吧，关键的地方你已经找到了。但文件呢？ 文件在％appdata％/microsoft/Credentials/目录下。解密时需要使用到这个文件

远程模式下没发现lsass进程。

崇拜你！
能给予指导或者提供源码学习吗？
3x

文件地址在3楼已经贴出来了的。
老外的文章说得很清楚，还分XP和win7了

不会吧？我还没来得及写代码。

1、CreateRemoteThread 远程线程注入lsass
2、使用未公开的LsaICryptUnprotectData 来解密credentials buffer

只有注入ＬＳＡＳＳ这一种办法了吗？