search

Credentials Hunting

Where do we look for credentials?

hashtag
Application Configuration Files

hashtag
Searching for files

We can use findstr to find clear text passwords:

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

We can also look for sensitive IIS info at C:\inetpub\wwwroot\web.config

hashtag
Dictionary Files

For example Chrome:

PS C:\hacker> gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password

hashtag
Unattended Installation Files

Windows unattended installations use configuration files like Autounattend.xml to automate OS setup. This skips manual input during installation, allowing for quicker and more consistent deployments.

unattend.xml serves a similar purpose as autounattend.xml, but it's mainly used for customizing already deployed systems.

circle-info

Unattended installation files may define auto-logon settings or additional accounts to be created as part of the installation. Passwords in the unattend.xml are stored in plaintext or base64 encoded.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <AutoLogon>
                <Password>
                    <Value>local_4dmin_p@ss</Value>
                    <PlainText>true</PlainText>
                </Password>
                <Enabled>true</Enabled>
                <LogonCount>2</LogonCount>
                <Username>Administrator</Username>
            </AutoLogon>
            <ComputerName>*</ComputerName>
        </component>
    </settings>

hashtag
PowerShell History File

Starting with Powershell 5.0 in Windows 10, PowerShell stores command history to the file:

C:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

hashtag
Confirm history filepath

hashtag
Read history file

We can also use this one-liner to retrieve the contents of all Powershell history files that we can access as our current user:

hashtag
Powershell Credentials

Credentials can be stored using Powershell variables. For example this sysadmin script:

circle-info

The credentials are protected using DPAPIarrow-up-right, which typically means they can only be decrypted by the same user on the same computer they were created on.

If we have gained command execution in the context of this user or can abuse DPAPI:

hashtag
Active Directory environment

We can use a tool such as Snafflerarrow-up-right to crawl network share drives for interesting file extensions such as .kdbx, .vmdk, .vdhx, .ppk, etc.

hashtag
Sticky Notes Password

We can often find credentials in sticky notes.

The sticky note app stores all the data in a sqlite database at C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

hashtag
Read with DB editor

We can copy the three plum.sqlite* files down to our system and open them with a tool such as DB Browser for SQLitearrow-up-right and view the Text column in the Note table with the query select Text from Note;.

hashtag
Read with Powershell

Using the PSSQLite modulearrow-up-right =>

hashtag
Read with strings

We can simply use strings on an Linux system.

hashtag
Other Interesting Files

Previous4 - Credentials TheftNextFurther Credentials Theft

Last updated