[Help]How to HOOK LogonUI.exe

[Howsk]

Hello everybody:

There is a question bothers me for a long time.

I want to get my computer's UserName、Domain、PassWord between LogonUI.exe and StartShell(Winlogon Notification Events),so i must HOOK it(LogonUI.exe),and i only want to HOOK it.I have referencesed some information,but failed.

So,everybody,How to HOOK LogonUI.exe can get UserName、Domain、PassWord?

Thanks.

Edited August 9, 2016 by Howsk
Change the Title

[Howsk]

My English is so bad,also please see understanding,also please forgive me.   

[Howsk]

Theres no one reply?

[A200K]

Why would you do this with hooking?

To get the user name and domain you don't need to do any special things, you can get them with just a WINAPI call.

Getting the passwords is a bit trickier, but you can dump and decrypt them from the lsass process. There is a open sourced project called mimikatz which does this, you can take a look at it:

https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa

Edited August 10, 2016 by A200K

[Howsk]

On 2016/8/10 at 2:34 PM, A200K said:

Why would you do this with hooking?

To get the user name and domain you don't need to do any special things, you can get them with just a WINAPI call.

Getting the passwords is a bit trickier, but you can dump and decrypt them from the lsass process. There is a open sourced project called mimikatz which does this, you can take a look at it:

https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa

Yeahh!Thank u very much,i have read this article,and i solved my problem now.really thank u.