Credentials in Registry - Red Teaming Experiments

Red Teaming Experiments

linkedin github @spotheplanet patreon

Search…

What is ired.team?

Pinned

Pentesting Cheatsheets

Active Directory & Kerberos Abuse

offensive security

Red Team Infrastructure

Code & Process Injection

Defense Evasion

Enumeration and Discovery

Privilege Escalation

Credential Access & Dumping

Dumping Credentials from Lsass Process Memory with Mimikatz

Dumping Lsass Without Mimikatz

Dumping Lsass without Mimikatz with MiniDumpWriteDump

Dumping Hashes from SAM via Registry

Dumping SAM via esentutl.exe

Dumping LSA Secrets

Dumping and Cracking mscash - Cached Domain Credentials

Dumping Domain Controller Hashes Locally and Remotely

Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy

Network vs Interactive Logons

Reading DPAPI Encrypted Secrets with Mimikatz and C++

Credentials in Registry

Password Filter

Forcing WDigest to Store Credentials in Plaintext

Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching Lsass

Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages

Pulling Web Application Passwords by Hooking HTML Input Fields

Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials

Credentials Collection via CredUIPromptForCredentials

Lateral Movement

reversing, forensics & misc

Dump Virtual Box Memory

AES Encryption Using Crypto++ .lib in Visual Studio C++

Reversing Password Checking Routine

Powered By GitBook

Credentials in Registry

Internal recon, hunting for passwords in Windows registry

Execution
Scanning registry hives for the value password:
[email protected]
1
reg query HKLM /f password /t REG_SZ /s
2
# or
3
reg query HKCU /f password /t REG_SZ /s
Copied!
Observations
As a defender, you may want to monitor commandline argument logs and look for any that include req query and passwordstrings:
References
Unsecured Credentials: Credentials in Registry, Sub-technique T1552.002 - Enterprise | MITRE ATT&CK®

Reading DPAPI Encrypted Secrets with Mimikatz and C++

Password Filter

Last modified 2yr ago

Copy link

Contents