search
inHTBTHM
githubEdit

Other Files

hashtag
Manually Searching the File System for Credentials

use this cheetsheet

https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/windows-privilege-escalation/

hashtag
Search File Contents for String

# search on password in this extentions
C:\htb> cd c:\Users\htb-student\Documents & findstr /SI /M "password" *.xml *.ini *.txt

# display full lines has password
C:\htb> findstr /si password *.xml *.ini *.txt *.config

# display the full line and number of it
C:\htb> findstr /spin "password" *.*

hashtag
Search File Contents with PowerShell

PS C:\htb> select-string -Path C:\Users\htb-student\Documents\*.txt -Pattern password

stuff.txt:1:password: l#-x9r11_2_GL!

hashtag
Search for File Extensions

hashtag
Sticky Notes Passwords

users sometimes use sticky notes to store password, not realizing it is a database file.

hashtag
Looking for StickyNotes DB Files

We can copy the three plum.sqlite* files down to our system and open them with a tool such as DB Browser for SQLitearrow-up-right and view the Text column in the Note table with the query select Text from Note;.

image.png

hashtag
Viewing Sticky Notes Data Using PowerShell

hashtag
Strings to View DB File Contents

We can also copy them over to our attack box and search through the data using the strings command, which may be less efficient depending on the size of the database.

hashtag
Other Interesting Files

PreviousCredential HuntingNextFurther Credential Theft

Last updated