Windows Services with Cached Credentials (LSA Secrets)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(365664);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/14");

  script_name(english:"Windows Services with Cached Credentials (LSA Secrets)");

  script_set_attribute(attribute:"synopsis", value:
"One or more Windows services on the remote host have cached credentials in LSA Secrets.");
  script_set_attribute(attribute:"description", value:
"One or more Windows services on the remote host are configured to run as a domain or local
user account rather than a built-in account (LocalSystem, LocalService, or NetworkService).
Windows automatically caches these account credentials in the LSA Secrets store
(HKLM\SECURITY\Policy\Secrets\_SC_<ServiceName>), making them potentially extractable via
OS Credential Dumping techniques (T1003.004).");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"agent", value:"windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Windows");

  script_dependencies("smb_enum_services_params.nasl");
  script_require_keys("SMB/svcs");

  exit(0);
}

include('structured_data_credential_exposure.inc');

var exposure, match, svcs, report;

svcs = get_kb_list('SMB/svc/*/cached_credentials');
if (empty_or_null(svcs))
  exit(0, 'No services with cached credentials found.');

foreach var key (sort(keys(svcs)))
{
  match = pregmatch(pattern:"^SMB/svc/(.+)/cached_credentials$", string:key);
  if (isnull(match)) continue;

  exposure = {
    'source': match[1],
    'source_type': 'SERVICE',
    'credential_type': 'GENERIC_PASSWORD'
  };

  structured_data_credential_exposure.append("exposures", exposure);
}

if (max_index(keys(structured_data_credential_exposure.data.exposures)) < 1)
  exit(0, 'No services with cached credentials found.');

structured_data_credential_exposure.report_internal();

report = '\nThe following services have credentials cached in LSA Secrets :\n\n';
foreach var exp (structured_data_credential_exposure.data.exposures)
  report += '  - ' + exp['source'] + '\n';

security_report_v4(port:0, severity:SECURITY_NOTE, extra:report);