findstr /si password *.txt
findstr /si password *.xml
dir /s *pass* == *cred* == *vnc* == *.config*
findstr /spin "password" *.*
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
findstr /si password *.ini
dir /b /s sysprep.inf
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" (Windows Autologin)
https://pentestlab.blog/tag/password/
https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
https://www.offensive-security.com/metasploit-unleashed/privilege-escalation/
http://carnal0wnage.attackresearch.com/2010/01/metasploit-getsystem-command.html?m=1
http://www.khromozome.com/windows-privilege-escalation-bypassuac/
https://www.redspin.com/it-security-blog/2010/02/getsystem-privilege-escalation-via-metasploit/