search
LinkedInGithub
githubEdit

other-files

hashtag
Searching File Contents for String

findstr /SI /M "password" *.xml *.ini *.txt

findstr /SI "password" *.xml *.ini *.txt *.config

findstr /SPIN "password" *.*

powershell "Select-String -Path C:\Users\htb-student\Documents\*.txt -Pattern password"

hashtag
Searching for File Extensions

dir /S /B *pass*.txt *pass*.xml *pass*.ini *cred* *vnc* *.config*

where /R C:\ *.config

powershell "Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore"

hashtag
Sticky Notes Database

ls C:\Users\htb-student\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\

powershell "Set-ExecutionPolicy Bypass -Scope Process; cd .\PSSQLite\; Import-Module .\PSSQLite.psd1; $db = 'C:\Users\htb-student\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite'; Invoke-SqliteQuery -Database $db -Query 'SELECT Text FROM Note' | Format-Table -Wrap"

strings plum.sqlite-wal

hashtag
Other Files of Interest

hashtag
Key Takeaways:

  • Diverse File Locations: - Credentials and sensitive data can be hidden in various file types and locations, including configuration files, databases, text documents, and even virtual disk images. - Network shares are a prime target, as users often store sensitive data without realizing the access permissions.

  • Tools and Techniques: - Snaffler: A valuable tool for crawling network shares and identifying files with specific extensions. - findstr: A command-line utility for searching file contents for specific strings. - PowerShell: A powerful scripting language for searching files, parsing data, and interacting with the system. - dir and where: Command-line utilities for searching for files based on their names and extensions. - DB Browser for SQLite: A GUI tool for examining SQLite databases, such as the Sticky Notes database. - PSSQLite PowerShell Module: a powershell module to query sqlite databases. - strings: A command-line utility for extracting printable strings from binary files.

  • Sticky Notes: - The Sticky Notes application stores data in an SQLite database, which can contain valuable information. - The plum.sqlite file and related files are located in the user's AppData directory.

  • Other Files of Interest: - The provided list highlights various system files and directories that may contain credentials or sensitive information. - Log files, configuration files, and registry hives are common targets.

  • Manual vs. Automated Searching: - While enumeration scripts are helpful, understanding how to perform manual searches is essential for thorough penetration testing. - Manual searches allow for flexibility and the ability to find information that automated tools may miss.

  • Security Awareness: - The text highlights the importance of user security awareness. Many users are unaware that files they save on network shares can be accessed by others.

Additional Considerations:

  • Regular Expressions: - For more complex searches, consider using regular expressions with findstr or PowerShell's Select-String cmdlet.

  • Encoding: - Be aware of different file encodings, as this can affect the ability to search for strings.

  • File Permissions: - Always check file permissions to ensure that you have the necessary access to read and modify files.

  • Environmental Variables: - The use of environmental variables such as %SYSTEMDRIVE% and %WINDIR% is very useful when dealing with various windows systems.

  • Safety: - When dealing with production systems, be very careful when searching for and handling sensitive data. - Always obtain proper authorization before conducting any penetration testing activities.

  • Post exploitation: - The files that are mentioned are extremely useful during post exploitation phases of a penetration test.

PreviousNetwork shares & mount virtual hard disksNextEnum password manager (keepass hashes)

Last updated