How to Read the Credentials cache from the Windows registry from c++

Question

Windows credentials are cached in the local system which are called local cache. This will allow the user to logon the system when unable to contact the domain controller.

These cached credentials are stored as hashes in the local systems registry at the values HKEY_LOCAL_MACHINE\\SECURITY\\CACHE\\NL$1 through NL$10. This is only accessible by the system account or we have to give the permissions to the administrator to perform actions.

Now I am trying to access these caches from my c++ code. But I have failed to get the values. Please give a solution to read and write these caches from a c++ code.

The code I am using:

DWORD GetLocalMachineProfileBuffer(BYTE* pBuffer, DWORD nMaxLength )
{
LPCWSTR szSubKey = L"SECURITY\\CACHE";
LPCWSTR szValueName = L"NL$1";

    DWORD   rc; 
    DWORD   dwType; 
    HKEY    hOpenedKey;

    if( ERROR_SUCCESS == RegOpenKeyEx (HKEY_LOCAL_MACHINE,szSubKey,0,KEY_READ,&hOpenedKey) )
    {
        rc = RegQueryValueEx(hOpenedKey,szValueName,0,&dwType,(LPBYTE)pBuffer,&nMaxLength ); 
        if( rc != ERROR_SUCCESS ) 
        { 
            return (DWORD)-1;
        } 
        else 
        { 
            _ASSERT( dwType == REG_BINARY ); 
        } 

        RegCloseKey( hOpenedKey );
        return nMaxLength; 
    }
    else
    {
        return (DWORD)-1;
    }   
}

int _tmain(int argc, _TCHAR* argv[])
{
    static BYTE Buffer[200];
    DWORD nLength = GetLocalMachineProfileBuffer( Buffer, sizeof( Buffer ) );

    for(int i=0;i<200;i++) {
            printf("%0X ",Buffer[i]);
    }
    getch();
    return 0;
}

Answer 1

In order to read this area of the registry you MUST be running as NT AUTHORITY\\SYSTEM , otherwise known as LocalSystem - the windows equivalent of unix root . I am guessing you are getting Access Denied, but you are throwing the error message away.

So this:

 if( rc != ERROR_SUCCESS ) 
    { 
        return (DWORD)-1;
    } 

Should be this:

   if( rc != ERROR_SUCCESS ) 
    { 
        return rc;
    } 

Then you can check the exit code using echo %ERRORLEVEL% or similar, and find out what error you are actually getting.

The best way to get a process running as SYSTEM is to create a job using the Task Scheduler API.

• start remote process within the context

You can do this on the local machine by specifying the local machine name.