Windows Password Recovery - Vault Explorer and Decoder
What is Windows Vault
Windows Vault is a protected storage for user or system secrets, passwords, network keys, web password and other personal information. Data stored in Windows Vault is structured and represents a set of records belonging to a certain Vault schema (see pic. below).
On the physical level, Vault is a disk-based folder with a set of the following files:
Windows Vault Explorer
Windows Vault Explorer is a utility for offline analyzing and decrypting Vault credentials. The decryption Wizard splits the entire process into the following steps:
Looking for Vault folder
There are currently two types of Vault storage: system and user. The user Vault storage can be located in the following folders:
Note that some of the specified folders have the system attribute set on, which makes these folders hidden.
Windows has VaultCmd.exe utility for creating and managing your own Vault storages.
Selecting Master Key
Once a certain Vault folder is selected, you need to specify path to the Master Key used in the protection of the Vault encryption keys. The user's Master Key always resides in the folder %APPDATA%\Microsoft\Protect\%SID%, and the system account's Master Keys are stored in %SYSTEMDIR%\Microsoft\Protect. It must be noted that there could be a number of Master Keys, while a specific object could be decrypted using only one key, the name of which is stored in the Policy.vpol file. When searching for the Master Key, the program can filter out unnecessary names.
Decrypting Master Key
To decrypt a user's Master Key, you need to provide at least two parameters: the user's logon password and his security identifier (SID), which is normally included in the path to the Master Key. The program finds user's SID automatically. If that hasn't been done for whatsoever reason, set it up manually. To decrypt the system's Master Key, we don't need to specify the password; the program will extract all the necessary information from the two registry files: SYSTEM and SECURITY.
Selecting Vault Schema
On the fourth step, if the previous ones passed successfully, the program prompts you to select one of the schemas belonging to our Vault from the dropdown list. Just below the list, we can see the general characteristics of the selected schema: its name, version, GUID, flags, number of attributes and credentials.
Selecting Vault credential
In a similar manner, select one of the credentials of interest that belongs to the schema we have selected during the previous step.
Decrypting Vault credential
And at last the final step, where you can view the decrypted record, copy it to clipboard or save to file for further analysis. The figure shows decrypted plain-text password (it is clobbered) of the administrator account configured to logon using biometric information (fingerprint).