3 ms·
I assume the author doing these under the Administrator account or had admin privilege.
by ww520 8y ago
I assume the author doing these under the Administrator account or had admin privilege.
- EvanAnderson 8y agoThey had the credentials for the user account under which the private keys were stored. This is a post-exploitation concern, not a vulnerability.
- kuroguro 8y agoYou can read them with or without admin access on the same user. On the other hand a different user's admin account wouldn't help unless you can dump the first user's password. https://msdn.microsoft.com/en-us/library/ms995355.aspx#windataprotection-dpapi_topic02 https://msdn.microsoft.com/en-us/library/ms995355.aspx#winda...