andshrew

Retrieving VMware Workstation VM encryption passwords saved in the the Windows Credential Manager

When creating an encrypted VM, VMware Workstation gives you the option to remember the password. It does this by storing the password in the Windows Credential Manager.

VMware does not provide a way to retrieve this stored password, but it can be accessed via the Win32 CredReadW API function.

There are a number of PowerShell projects including PowerShell Credential Manager which provide access to this API, but in testing I found they were unable to correctly display the VMware password.

This PowerShell example has been tested using Windows PowerShell (v5.1) and PowerShell (v7) using VMwa

montasim

KFZUS-F3JGV-T95Y7-BXGAS-5NHHP
T3ZWQ-P2738-3FJWS-YE7HT-6NA3K
KFZUS-F3JGV-T95Y7-BXGAS-5NHHP
65Z2L-P36BY-YWJYC-TMJZL-YDZ2S
SFZHH-2Y246-Z483L-EU92B-LNYUA
GSZVS-5W4WA-T9F2E-L3XUX-68473
FTZ8A-R3CP8-AVHYW-KKRMQ-SYDLS
Q3ZWN-QWLZG-32G22-SCJXZ-9B5S4
DAZPH-G39D3-R4QY7-9PVAY-VQ6BU
KLZ5G-X37YY-65ZYN-EUSV7-WPPBS

n1snt

Oh my zsh.

Install ZSH.

sudo apt install zsh-autosuggestions zsh-syntax-highlighting zsh

Install Oh my ZSH.

jerblack

package main

import (
	"fmt"
	"io"
	"log"
	"os"
)

func main() {

mholt

package main

import (
	"github.com/kardianos/service"
	"log"
	"flag"
)

type Service struct {}

NaniteFactory

package main

//#include "dllmain.h"
import "C"

infosecn1nja

# Fileless WMI Persistence (PSEDWMIEvent_SU - SystemUptime)
# https://wikileaks.org/ciav7p1/cms/page_14587908.html

<#
.SYNOPSIS
This script creates a persisted WMI event that executes a command upon trigger of the system's uptime being between a given range in seconds.  The event will trigger only once.  
#>

$EventFilterName = "Fileless WMI Persistence SystemUptime"

gchudnov

#include <string> 
#include <locale> 
#include <codecvt> 
 
//UTF-8 to UTF-16 
std::string source; 
//... 
std::wstring_convert<std::codecvt_utf8_utf16<char16_t>,char16_t> convert; 
std::u16string dest = convert.from_bytes(source);     
 

yongzhy

// from http://www.goinggo.net/2013/11/using-log-package-in-go.html

import (
	"io"
	"log"
)

var (
	_TRACE   *log.Logger
	_INFO    *log.Logger