Trouble running in user context -- System utility: CMDKey.exe

Content Authoring
1

I have been trying to get a list of all stored credentials on a Windows 10 system and run into a bit of a wall. Thought I’d see if anyone else has come across this or has a suggestion. The System user command runs fine (and generates a log) however as a user it generates an empty log with no results (even if the user has no entries in their credential manager you should get output). I have attempted with/without 64 redirection and attempting both the native system folder and system folder. Also attempted with interaction and saw the CMD box but no change in logging result.

Latest AS:

//------------------------------------------------------------
if {x64 of operating system}
action uses wow64 redirection {not x64 of operating system}
endif

waithidden cmd /c {native system folder}\cmdkey.exe /list > c:\programdata\InvCredMgr_SYS

delete {“c:\programdata\InvCredMgr_” & name of logged on user whose (active of it) as string}

override wait
completion=job
hidden=true
runas=currentuser
wait cmd /c {native system folder}\cmdkey.exe /list > c:\programdata\InvCredMgr_%username%

//------------------------------------------------------------

2

I haven’t used cmdkey myself, and don’t know whether this is the only issue, but I see a problem on this line

wait cmd /c {native system folder}\cmdkey.exe /list > c:\programdata\InvCredMgr_%username%

The %username% would only evaluate as an environment variable in the context of a batch file; %username% has no special meaning to Bigfix Actionscript. Try a relevance substitution instead, such as you did on the delete line

wait cmd /c {native system folder}\cmdkey.exe /list > {“c:\programdata\InvCredMgr_” & name of logged on user whose (active of it) as string}

3

Jason,
Interestingly enough the %username% expansion is happening successfully for the user context the fixlet runs under and generating the expected logname. I’ve also attempted to hard path the log name temporarily.

4

Worth mentioning, running the command below from an interactive command prompt succeeds and generates the log with expected content:
cmdkey.exe /list > c:\programdata\InvCredMgr_%username%

Log output: c:\programdata\InvCredMgr_Nick
Target: LegacyGeneric:target=msteams_adalsso/adal_context_15
Type: Generic
Local machine persistence

Target: WindowsLive:target=virtualapp/didlogical
Type: Generic
User: 02xfsznmroddlmdv
Local machine persistence

Target: LegacyGeneric:target=msteams_adalsso/adal_context_3
Type: Generic
Local machine persistence

…

5

Well that’s … unexpected on may part. Learn something new every day!

Try to see whether the script is giving any error output by redirecting stdout as well…

wait cmd /c {native system folder}\cmdkey.exe /list > {“c:\programdata\InvCredMgr_” & name of logged on user whose (active of it) as string} 2>&1

6

Good call; I forgot to do redirection.

So the instance run from system dumps to the log:
Currently stored credentials:

  • NONE *

While the user run instance dumps to the log:
The current directory is invalid.

So as expected the utility is having trouble with BigFix calling as the user but curious result

7

Ah, I have an idea. When running as the current user, the process won’t have access to the BES Client\__BESData directory.

Try using appendfile to create this as a batch file, copy (not move) the batch out of BESData, and try running that batch as the current user.

8

Definitely true. The BESClient directory is usually unavailable to a generic user so if running with user permissions you would have to do this in a directory available to the user though knowing where that is is hard due to any environment variable being that for the SYSTEM user. You could figure out a safe space for the user based on usual paths though

9

I did modify the content to create & copy the file out to a place where users have rights to execute. Unfortunately I ended up with the same directory invalid message.

I have ended up going a slightly different way; for whatever reason (weird context thingy?) I was able to get the agent to run the command within a vbs wrapper.

//------------------------------------------------------
waithidden cmd /c { system folder}\cmdkey.exe /list > c:\programdata\InvCredMgr_SYS 2>&1

createfile until EOF
Set objshell = CreateObject(“WScript.shell”)
strCmd = "cmd /c c:\windows\system32\cmdkey.exe /list > c:\programdata\InvCredMgr_%username% 2>&1"
result = objShell.Run( strCmd, 0, true)
EOF
delete c:\programdata\InvCredMgr.vbs
copy __createfile c:\programdata\InvCredMgr.vbs

if {exists logged on users whose (active of it)}
override wait
completion=job
hidden=true
runas=currentuser
wait wscript c:\programdata\InvCredMgr.vbs
endif
//------------------------------------------------------

10

This line may not be correct, as it will be true if there is a user that is not the “current user” so it should be

if {exists current user whose(active of it)}

The logged on user inspector will give you back users that are not the “current user” which is the console user

11

Thanks Alan, good catch