Credentials Hunting

Where do we look for credentials?

Application Configuration Files

Searching for files

We can use findstr to find clear text passwords:

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

We can also look for sensitive IIS info at C:\inetpub\wwwroot\web.config

Dictionary Files

For example Chrome:

PS C:\hacker> gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password

Unattended Installation Files

Windows unattended installations use configuration files like Autounattend.xml to automate OS setup. This skips manual input during installation, allowing for quicker and more consistent deployments.

unattend.xml serves a similar purpose as autounattend.xml, but it's mainly used for customizing already deployed systems.

Unattended installation files may define auto-logon settings or additional accounts to be created as part of the installation. Passwords in the unattend.xml are stored in plaintext or base64 encoded.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <AutoLogon>
                <Password>
                    <Value>local_4dmin_p@ss</Value>
                    <PlainText>true</PlainText>
                </Password>
                <Enabled>true</Enabled>
                <LogonCount>2</LogonCount>
                <Username>Administrator</Username>
            </AutoLogon>
            <ComputerName>*</ComputerName>
        </component>
    </settings>

PowerShell History File

Starting with Powershell 5.0 in Windows 10, PowerShell stores command history to the file:

C:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Confirm history filepath

Read history file

We can also use this one-liner to retrieve the contents of all Powershell history files that we can access as our current user:

Powershell Credentials

Credentials can be stored using Powershell variables. For example this sysadmin script:

The credentials are protected using DPAPI, which typically means they can only be decrypted by the same user on the same computer they were created on.

If we have gained command execution in the context of this user or can abuse DPAPI:

Active Directory environment

We can use a tool such as Snaffler to crawl network share drives for interesting file extensions such as .kdbx, .vmdk, .vdhx, .ppk, etc.

Sticky Notes Password

We can often find credentials in sticky notes.

The sticky note app stores all the data in a sqlite database at C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

Read with DB editor

We can copy the three plum.sqlite* files down to our system and open them with a tool such as DB Browser for SQLite and view the Text column in the Note table with the query select Text from Note;.

Read with Powershell

Using the PSSQLite module =>

Read with strings

We can simply use strings on an Linux system.

Other Interesting Files

Previous4 - Credentials TheftNextFurther Credentials Theft

Last updated