Step by step guide for n00bs.
Make sure you have the following software installed:
- EnterpriseWifiPasswordRecover (download release build or compile it yourself)
- psexec (download & extract the zip. Optionally you can add the location to your PATH variable)
Open cmd as administrator, navigate to the directory where you downloaded the extractor tool and run it for the first time:
cd D:\Downloads\EnterpriseWifiPasswordRecover && EnterpriseWifiPasswordRecover.exe.
You will get an output similar to:
{BF946-6E93-4F91-B312-2EB6FAA70F06}
Extracted stage1 for {458BF946-6E93-4F91-B312-2EB6FAA70F06}
{7B32105C-31A1-4700-9537-B975DEBD237A}
Extracted stage1 for {7B32105C-31A1-4700-9537-B975DEBD237A}
{9662200A-3BE5-4FB0-A366-E39016D60019}
Extracted stage1 for {9662200A-3BE5-4FB0-A366-E39016D60019}
{458BF946-6E93-4F91-B312-2EB6FAA70F06}
Extracted stage1 for {458BF946-6E93-4F91-B312-2EB6FAA70F06}
{7B32105C-31A1-4700-9537-B975DEBD237A}
Extracted stage1 for {7B32105C-31A1-4700-9537-B975DEBD237A}
{9662200A-3BE5-4FB0-A366-E39016D60019}
Extracted stage1 for {9662200A-3BE5-4FB0-A366-E39016D60019}
Failed to decrypt {458BF946-6E93-4F91-B312-2EB6FAA70F06} - Run as SYSTEM or ORIGINAL USER!
Failed to decrypt {7B32105C-31A1-4700-9537-B975DEBD237A} - Run as SYSTEM or ORIGINAL USER!
Failed to decrypt {9662200A-3BE5-4FB0-A366-E39016D60019} - Run as SYSTEM or ORIGINAL USER!
The tool is done with the first round now and waits for you to continue as the SYSTEM user.
To log in as the SYSTEM user, execute psexec.exe -i -s powershell.exe. A new powershell window should pop up. From there, execute the command above again. The tool will continue and extract the email address and domain (if present) for you:
Found encrypted password blob...
Failed to decrypt password --- This needs to be run as the user who owns the password
Found the following:
Domain:
Username: [email protected]
Password:
Now to get the password, go back to your cmd window and make sure you are logged in as the user who initially entered the credentials of the wifi network on your computer. Finally, execute the extractor one last time and you're done!
Found encrypted password blob...
Found the following:
Domain:
Username: [email protected]
Password: mysecretpassword123
Worked for me on Windows 10 Enterprise 22H2 19045.4239 👍