A local user can gain access to potentially sensitive data.
The researcher “Swiss knife” recently published in his blog a new version of the utility mimikatz 1.0, designed to work with the credentials on OS Windows. In the new version, in addition to functional, similar to Windows Credentials Editor, has been implemented functionality of obtaining the user’s password in cleartext.
The gap used mimikatz, associated with the implementation of WDigest.dll, designed for Digest authentication. Features of the implementation of HTTP Digest Authentication mechanism to support SSO (Single Sign On) require knowledge of the password entered, and not only its hash. Therefore, Windows developers have decided to store the passwords in the clear.
To view a list of passwords of authorized users on the system must perform the following command: