Why decryption of computer's LAPS of(xxx.com) not working in my computer(yyy.com) ,but it works fine in DC of xxx.com ?

Dinesh Kumar A 5 Reputation points
2023-10-27T07:40:28.6+00:00
#include "stdafx.h"
#include <iostream>
#include <windows.h>
#include <comdef.h>
#include <ActiveDS.h>
#include <dpapi.h>
#include <ncryptprotect.h>
#include <strsafe.h>
SECURITY_STATUS __stdcall Pfncryptstreamoutputcallback(
	void* pvCallbackCtxt,
	const BYTE* pbData,
	SIZE_T cbData,
	BOOL fFinal
) {
	std::cout << "Total Objects: 12 " << "\n";

	// Assuming you have already allocated memory for the data buffer
	for (size_t i = 0; i < cbData; ++i) {
		printf("%c", pbData[i]);
	}

	// Don't forget to free the allocated memory
	return ERROR_SUCCESS;
}
int _tmain(int argc, _TCHAR* argv[])
{

	CoInitialize(NULL);
	HRESULT hr = S_OK;
	IDirectorySearch* pDirSearch = NULL;
	LPCWSTR username = L"xxx";
	LPCWSTR password = L"xxx!";
	LPWSTR path = L"LDAP://xxxx/DC=xxx,DC=com";
	hr = ADsOpenObject(path, username, password, ADS_SECURE_AUTHENTICATION, IID_IDirectorySearch, (void**)&pDirSearch);
	if (SUCCEEDED(hr))
	{
		LPWSTR QueryStr = new WCHAR[256];
		wcscpy(QueryStr, L"(cn=G-TEAM)");
		LPWSTR attributes[] = { L"distinguishedName", L"msLAPS-EncryptedPassword" };
		DWORD attributeCount = sizeof(attributes) / sizeof(LPWSTR);
		ADS_SEARCH_HANDLE hSearch2;
		ADS_SEARCH_COLUMN col{};
		ADS_SEARCHPREF_INFO SearchPref[3];
		SearchPref[0].dwSearchPref = ADS_SEARCHPREF_SEARCH_SCOPE;
		SearchPref[0].vValue.dwType = ADSTYPE_INTEGER;
		SearchPref[0].vValue.Integer = ADS_SCOPE_SUBTREE;

		SearchPref[1].dwSearchPref = ADS_SEARCHPREF_PAGESIZE;
		SearchPref[1].vValue.dwType = ADSTYPE_INTEGER;
		SearchPref[1].vValue.Integer = 1000;
		SearchPref[2].dwSearchPref = ADS_SEARCHPREF_CACHE_RESULTS;
		SearchPref[2].vValue.dwType = ADSTYPE_BOOLEAN;
		SearchPref[2].vValue.Boolean = FALSE;

		pDirSearch->SetSearchPreference(SearchPref, 3);
		hr = pDirSearch->ExecuteSearch(QueryStr, attributes, attributeCount, &hSearch2);
		int count = 0;
		while ((hr = pDirSearch->GetNextRow(hSearch2)) == S_OK)
		{
			ADS_SEARCH_COLUMN controlCol;
			hr = pDirSearch->GetColumn(hSearch2, L"msLAPS-EncryptedPassword", &controlCol);
			std::cout << "Total Objects1: " << count << "\n";
			if (controlCol.dwNumValues > 0)
			{
				for (DWORD i = 0; i < controlCol.dwNumValues; ++i)
				{
					NCRYPT_PROTECT_STREAM_INFO info;
					info.pfnStreamOutput = &Pfncryptstreamoutputcallback;
					info.pvCallbackCtxt = NULL;
					NCRYPT_STREAM_HANDLE handle;
					SECURITY_STATUS ret;
					ret = NCryptStreamOpenToUnprotect(&info, NCRYPT_SILENT_FLAG, NULL, &handle);
					BYTE* encryptedPass = static_cast<BYTE*>(controlCol.pADsValues[i].OctetString.lpValue);
					SIZE_T encryptedPassLength1 = 0;
					SIZE_T encryptedPassLength = controlCol.pADsValues[i].OctetString.dwLength;
					for (size_t i = 0; i < encryptedPassLength; ++i) {
						printf("%02X ", encryptedPass[i]);
					}
					std::cout << "Encrpted PassLength: " << encryptedPassLength << "\n";
					std::cout << "Total Objects5: " << count << "\n";
					if (ret == ERROR_SUCCESS) {
						SIZE_T offset = 16;
						SIZE_T sizeToCopy = encryptedPassLength - offset;
						BYTE* alloc = (BYTE*)LocalAlloc(LPTR, sizeToCopy);
						if (alloc != nullptr) {
							memcpy(alloc, encryptedPass + offset, sizeToCopy);
						}
						SIZE_T size = LocalSize(alloc);
						if (size != 0) {
							printf("Allocated size: %u bytes\n", size);
						}
						for (size_t i = 0; i < sizeToCopy; ++i) {
							printf("%02X ", alloc[i]);
						}
						std::cout << "Total Objects10: " << count << "\n";
						ret = NCryptStreamUpdate(handle, alloc, encryptedPassLength - offset, TRUE);

					}
					if (hSearch2)pDirSearch->CloseSearchHandle(hSearch2);
					if (pDirSearch)pDirSearch->Release();
				}
			}


		}

	}
	CoUninitialize();

	return 0;
}

While executing NCryptStreamUpdate() it fails in my computer but works fine in actual DC of G-team computer why decryption fails?Is Decryption of computer only possible in domain joined computers?

I am inquiring about the decryption of LAPS (Local Administrator Password Solution), and I would like to know if attempting decryption of LAPS passwords would violate Microsoft's policies. We are interested in providing a LAPS feature for our customers to view decrypted passwords. As we haven't found any official documentation on how to decrypt LAPS passwords using CNG DPAPI , we have studied the 'Get-LAPSADPassword' cmdlet to understand the encryption process to decrypt it using c++ instead of powershell.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
11,134 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,153 questions
{count} votes