> For the complete documentation index, see [llms.txt](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/privilege-escalation/windows/password-harvesting.md).

# Password harvesting

### Unattended installations

The following locations may contain administrative credentials that are used in unattended installations:

* `C:\Unattend.xml`
* `C:\Windows\Panther\Unattend.xml`
* `C:\Windows\Panther\Unattend\Unattend.xml`
* `C:\Windows\system32\sysprep.inf`
* `C:\Windows\system32\sysprep\sysprep.xml`

### Powershell History

The Powershell history can be viewed using Powershell at the file path: `$Env:userprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`

To view the file from a command prompt (`cmd.exe`), replace the `$Env:userprofile` at the start of the previously shown path to `%userprofile%`.

***Powershell***

```powershell
PS> type $Env:userprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
PS> Get-Content $Env:userprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
```

***Command prompt (cmd.exe)***

```powershell
cmd> type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
cmd> Get-Content %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
```

> The `type` command is an alias for the `Get-Content` cmdlet.

***Purpose of viewing the Powershell history***:

There may be instances where there might be plaintext passwords provided directly to commands for user creation, login, etc. These passwords can be retrieved by viewingh the history.

```powershell
# Eg. Adding a new user to a resource, while providing plaintext password
cmdkey /add:<target_resource> /user:<username> /pass:<plaintext_password>
```

### Saved credentials

View the stored credentials

The example below shows that the credentials for a user `rand_username` is stored:

```powershell
C:\> cmdkey /list

Currently stored credentials:
  
    Target: Domain:interactive=rand_username       
    Type: Domain Password                           
    User: rand_username

...
```

We can used the stored credentials to run command as the user:

```powershell
C:\> runas /savecred /user:rand_username <command_to_run>
```

### Internet Information Services (IIS)

The internet information services is a default web server on Windows installations. The configuration file is named `web.config`, which can store passwords for authentication for various services. Depending on the installed version of ***IIS***, the `web.config` file can be found in the following locations:

* `C:\inetpub\wwwroot\web.config`
* `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config`

The following command allows us to find database connection strings from the `web.config` file:

```powershell
C:\> type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString
```

This command consists of two parts separated by the pipe (`|`) operator:

1. `type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config`
   * View the contents of the `web.config` file
2. `findstr connectionString`
   * Utilizes the `findstr` command (similar to the `grep` command in Unix based systems) to find filter out the portion of the contents regarding the database connection strings

### Retrieve credentials from software

#### 1. Putty

The following command searches for stored proxy credentials under Putty:

```powershell
C:\> reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s
```

The `reg query` command is used to retrieve or query information from the Windows registry. The `/f` flag is used to filter strings, while the `/s` flag is used to specify the command to search recursively.

> Simon Tatham is the creator of PuTTY (and his name is part of the path), not the username for which we are retrieving the password.