Monday, March 24, 2025

[tryhackme][Windows][Credential Restoration] Cred_Restoration.bat

 @echo off

echo(

echo Showing significant files...


IF EXIST "C:\Unattend.xml" (

    echo C:\Unattend.xml exists.

)


IF EXIST "C:\Windows\Panther\Unattend.xml" (

    echo C:\Windows\Panther\Unattend.xml exists.

)


IF EXIST "C:\Windows\Panther\Unattend\Unattend.xml" (

    echo C:\Windows\Panther\Unattend\Unattend.xml exists.

)


IF EXIST "C:\Windows\system32\sysprep.inf" (

    echo C:\Windows\system32\sysprep.inf exists.

)


IF EXIST "C:\Windows\system32\sysprep\sysprep.xml" (

    echo C:\Windows\system32\sysprep.inf exists.

)


IF EXIST "%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" (

    echo %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt exists.

)


IF EXIST "C:\inetpub\wwwroot\web.config" (

    echo C:\inetpub\wwwroot\web.config exists.

)


IF EXIST "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config" (

    echo C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config exists.

)


echo(

echo Showing saved credentials on the system...


cmdkey /list


echo(

echo Show Putty Proxy passwords...


reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s

No comments:

Post a Comment