C ++：如何在Windows Credential Manager中以编程方式创建本地用户登录凭据，以便“ runas / savecred”可以使用它？

Question

I am trying to set an executable to run as a local low-privileged user (different from the current logged-on user) by default. The Windows command "runas /savecred /user:username appname.exe" can do it, but it requires the current logged-on user to manually type in password of the different user at the first time. Ideally, I want the installer of the program set the credential, so no interaction would be needed for the current logged-on user. (I don't want to make the program as a Windows Service for other good reasons.)

When I ran the "runas" command, I observed that a new "interactive logon" Windows Credential got created in the Credential Manager, where "Internet or network address" was set as "$computer_name\\$username (Interactive Logon)", "User name" was set as "$computer_name\\$username", "password" was displayed as "********", and "Persistence" was set as "Enterprise".

Based on that observation, I found a Win32 API, CredWrite, and but I'm having trouble to make it work. I got error code 87 (ERROR_INVALID_PARAMETER - The parameter is incorrect.) when CredWrite was called.

#include <windows.h>
#include <wincred.h>
#include <tchar.h>

void main ()
{
    char* password = "randompassword";
    DWORD blobsize= 1 + strlen(password);

    CREDENTIAL cred = {0};
    cred.Flags = CRED_FLAGS_USERNAME_TARGET;
    cred.Type = CRED_TYPE_DOMAIN_PASSWORD;
    cred.TargetName = L"computername\\username";
    cred.CredentialBlobSize = blobsize;
    cred.CredentialBlob = (LPBYTE) password;
    cred.Persist = CRED_PERSIST_LOCAL_MACHINE;
    cred.UserName = L"computername\\username";

    if (!CredWrite(&cred, 0))
    {
        std::cerr << GetLastError() << std::endl;
    }
}

The references that I have been looking at are listed at the bottom. I was able to create a CRED_TYPE_GENERIC type credential but it was not recognized by RUNAS. I'm really puzzled on how to set fields like TargetName and Type in order to programmatically create an interactive logon credential as RUNAS does. The official MSDN documentation isn't clear and there is no example.

CredWrite : https://msdn.microsoft.com/en-us/library/windows/desktop/aa375187(v=vs.85).aspx CREDENTIAL: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374788(v=vs.85).aspx The sample code for creating a CRED_TYPE_GENERIC type credential: How do I store and retrieve credentials from the Windows Vault credential manager?

Answer 1

There is an undocumented Flag of the CREDENTIAL structure that you pass to CredWrite.

If you call the API with flag = 8196, you will get the result you desire

char* password1 = "randompassword";
DWORD blobsize = strlen(password1); // Do NOT add 1 here.

CREDENTIAL cred = { 0 };
cred.Flags = 8196;
cred.Type = 2;
cred.TargetName = L"computername\\username";
cred.CredentialBlobSize = blobsize;
cred.CredentialBlob = (LPBYTE)password1;
cred.Persist = 3;
cred.UserName = L"computername\\username";

if (!CredWrite(&cred, 0))
{
    std::cerr << GetLastError() << std::endl;
}

Answer 2

The ERROR_INVALID_PARAMETER error (error code 87) was caused by the wrong value of CredentialBlobSize. "If the Type member is CRED_TYPE_DOMAIN_PASSWORD, this member contains the plaintext Unicode password for UserName. The CredentialBlob and CredentialBlobSize members do not include a trailing zero character." (CREDENTIAL: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374788(v=vs.85).aspx )

With this fix a Windows Credential (not Generic or Certificate-based Credential) can be created without error.

#include <windows.h>
#include <wincred.h>
#include <tchar.h>

void main ()
{
    char* password = "randompassword";
    DWORD blobsize= strlen(password); // Do NOT add 1 here.

    CREDENTIAL cred = {0};
    cred.Flags = CRED_FLAGS_USERNAME_TARGET;
    cred.Type = CRED_TYPE_DOMAIN_PASSWORD;
    cred.TargetName = L"computername\\username";
    cred.CredentialBlobSize = blobsize;
    cred.CredentialBlob = (LPBYTE) password;
    cred.Persist = CRED_PERSIST_LOCAL_MACHINE;
    cred.UserName = L"computername\\username";

    if (!CredWrite(&cred, 0))
    {
        std::cerr << GetLastError() << std::endl;
    }
} 

However, there is still a subtle difference. The "Internet or network address" of the one that I created was "$computer_name\\$username ( Windows Identity )" which cannot be recognized by RUNAS. The one created by RUNAS was "$computer_name\\$username ( Interactive Logon )". How does that bit get set?

I can use CredRead to read the credential that I created, but fail to do that for the one created by RUNAS.

CREDENTIAL cred = { 0 };
PCREDENTIAL pcred = &cred;
// Works for Windows Identity. TargetName is case-insensitive.
CredRead(L"$computer_name\$username", CRED_TYPE_DOMAIN_PASSWORD, 0, &pcred); 
// Fails for Interactive Logon with error code 87 or 1168. I tried all possible CRED_TYPE_*.
CredRead(L"$computer_name\$username", CRED_TYPE_*, 0, &pcred); 

Similar threads: 1. Runas Command, Bypass Credentials ( https://community.spiceworks.com/topic/485852-runas-command-bypass-credentials ) 2 .runas /savecred… don't accept cmdkey /add (credentials) ( runas /savecred... don't accept cmdkey /add (credentials) ) 3. runas with the /savecred switch does not accept a credential stored by the cmdkey command ( https://social.technet.microsoft.com/Forums/windowsserver/en-US/c0e398cc-224f-4390-bc69-0ee544f9b5cb/runas-with-the-savecred-switch-does-not-accept-a-credential-stored-by-the-cmdkey-command?forum=winserversecurity )

CMDKEY command allowed me to create a credential closest to the one created by RUNAS. Both look the same in the result returned by "cmdkey /list". However, the one created by CMDKEY is not honored by RUNAS.

cmdkey /add:Domain:interactive=$computer_name\$username1 /user:$computer_name\$username1 /pass:$password

cmdkey /list

# created by CMDKEY
Target: Domain:interactive=$computer_name\$username1
Type: Domain Password
User: $computer_name\$username1

# created by RUNAS
Target: Domain:interactive=$computer_name\$username2
Type: Domain Password
User: $computer_name\$username2