Under Windows 9x, any passwords that were "saved" were stored in the .pwl files for each user. These passwords could be retrieved in plaintext by any application using the WNetEnumCachedPasswords() API, which was not included in the header files or libraries distributed with the Win32 sdk but was included in the files that came with the Win 95 ddk. Windows NT, however, does not have this API but all the information about the RAS connections, including VPN and direct serial connections, can be retrieved using the RasGetCredentials() API with each of the RAS connections that is returned by RasEnumEntries().

Microsoft actually fixed the plaintext password problem with Win2k which returns a "handle" instead of the actual password which you can pass to other RAS APIs that expect passwords. All the rest of the information will still be displayed under 2k but the password may apear as a string of *'s. This program may not run properly under 9x, if at all.


RasEnum.exe is a small program which lists the information for all of the entries in any phonebook file (.pbk). If you do not provide the path to a pbk file, the default ras pbk is used, usually %windir%\system32\ras\rasphone.pbk.

Get Source HERE.
Get the EXE here.