Hello everybody:

There is a question bothers me for a long time.

I want to get my computer's UserName、Domain、PassWord between LogonUI.exe and StartShell(Winlogon Notification Events),so i must HOOK it(LogonUI.exe),and i only want to HOOK it.I have referencesed some information,but failed.

So,everybody,How to HOOK LogonUI.exe can get UserName、Domain、PassWord?

Thanks.

Edited August 9, 20169 yr by Howsk
Change the Title

My English is so bad,also please see understanding,also please forgive me.   

Theres no one reply?

Why would you do this with hooking?

To get the user name and domain you don't need to do any special things, you can get them with just a WINAPI call.

Getting the passwords is a bit trickier, but you can dump and decrypt them from the lsass process. There is a open sourced project called mimikatz which does this, you can take a look at it:

https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa

Edited August 10, 20169 yr by A200K

On 2016/8/10 at 2:34 PM, A200K said:

Why would you do this with hooking?

To get the user name and domain you don't need to do any special things, you can get them with just a WINAPI call.

Getting the passwords is a bit trickier, but you can dump and decrypt them from the lsass process. There is a open sourced project called mimikatz which does this, you can take a look at it:

https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa

Yeahh!Thank u very much,i have read this article,and i solved my problem now.really thank u.