Credentials in Registry
Sub-technique of T1552 Unsecured Credentials ↗
Reading passwords stored in the Windows registry: autologon, PuTTY, VNC or third-party software.
How it shows up on Hack The Box
winPEAS checks it automatically, but by hand start with Winlogon (DefaultPassword) and the installed software keys in HKLM and HKCU.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Windows and Active Directory privilege escalation › Windows
Check (both keys set to 1)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Autologon in the registry
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"No command matches.