Hunting for Credentials
Admins leave passwords everywhere. Config files, the registry, saved sessions, and memory all leak them.
What you will learn
- -Search the filesystem and registry for hardcoded passwords
- -Pull saved credentials from cmdkey, WiFi, and browsers
- -Explain when to reach for a memory dump over LSASS
The most reliable Windows privesc is a someone left lying around. No , no race condition, just a working for a higher account. On a real this also moves you sideways, since people reuse passwords across boxes. So after you've checked your and the services, start looting.
Files on disk
Unattended install files are the classic first hit. Windows deployment tools write an admin password into them and admins forget to scrub it. Check the usual spots.
$dir /s /b C:\unattend.xml C:\Windows\Panther\Unattend.xml$findstr /si password *.xml *.ini *.config *.txtBroaden it once the obvious spots are dry. Web app configs, backup scripts, and a user's Documents folder all leak. history is a goldmine because people paste credentials into commands.
$type %USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txtThe registry
Software stashes credentials in the constantly. Autologon is the highest value: if it's configured, the password sits in .
$reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword$reg query HKLM /f password /t REG_SZ /sSaved sessions and creds
Windows caches credentials for RDP, network , and WiFi. cmdkey lists what's stored, and stored creds can often be reused without ever seeing the plaintext.
$cmdkey /list$netsh wlan show profile name="CorpWiFi" key=clearIf cmdkey /list shows a stored credential for another user, you often don't need the password at all. Launch a process as that user with runas /savecred, which pulls the saved for you.
Browsers keep saved logins too. LaZagne pulls them, along with dozens of other credential stores, in one pass.
$lazagne.exe allMemory
When the disk and registry come up empty and you already have admin, holds the plaintext and hashes of everyone logged in. Dumping it is loud and watches for it, so it's a later move, not a first one. On an authorized engagement, dump the process and parse it offline rather than running live where AV will eat it.
$rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump <lsass_pid> C:\\Temp\\lsass.dmp fullHarvesting stored passwords and dumping LSASS exposes real credentials for real people. Only do this on systems you own or are explicitly authorized to test, and handle any credential material you recover as sensitive engagement data.
Before you fire up a cracker, try the password you found against other accounts and other . Reuse is rampant. One config-file password often you into three more boxes as an admin.
You find a stored credential for a domain admin in cmdkey /list but cannot see the plaintext. What is the fastest way to use it?
On a lab box, run the findstr password search, cmdkey /list, and the PowerShell history read. Record every credential or hint you find, then test one recovered password against a second account to check for reuse.