killchain-compendium/Post Exploitation/Windows/Registry.md

Windows Registry

AutoLogin Password

Automatic logon password is save in plaintext

reg query "HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon"

Search for Passwords

Use reg to search for passwords inside Keys of the registry via the following line.

reg query HKLM /f "password" /t REG_SZ /s