???????????????????????

????Windows
????Windows???????????е??Щ????base64???洢λ??
C:unattend.xml
C:WindowsPantherUnattend.xml
C:WindowsPantherUnattendUnattend.xml
C:Windowssystem32sysprep.inf
C:Windowssystem32sysprepsysprep.xml
???????Metasploit?? post/windows/gather/enum_unattend ????????????
????IIS????????web.config???????·????
????C:WindowsMicrosoft.NETFramework64v4.0.30319Configweb.config
????C:inetpubwwwrootweb.config
?????????????????￡?
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authentication mode="Windows">
<forms>
<credentials passwordFormat="Clear">
<user name="Admin" password="Admin" />
</credentials>
</forms>
</authentication>
</system.web>
</configuration>
?????????????groups.xml??????????Щ????洢???????
C:ProgramDataMicrosoftGroup PolicyHistory????MachinePreferencesGroupsGroups.xml
\domainSYSVOL\Policies????MACHINEPreferencesGroupsGroups.xml
ServicesServices.xml
ScheduledTasksScheduledTasks.xml
PrintersPrinters.xml
DrivesDrives.xml
DataSourcesDataSources.xml
???????????
???????????????????????????
findstr /si password *.txt
findstr /si password *.xml
findstr /si password *.ini
?????????????λ???
C:> dir /b /s unattend.xml
C:> dir /b /s web.config
C:> dir /b /s sysprep.inf
C:> dir /b /s sysprep.xml
C:> dir /b /s *pass*
C:> dir /b /s vnc.ini
?????????????
????McAfee
????McAfee????????洢??sitelist.xml????У?
????%AllUsersProfile%Application DataMcAfeeCommon FrameworkSiteList.xml
????VNC
????UltraVNC
????[ultravnc]
????passwd=5FAEBBD0EF0A2413
????RealVNC
????RealVNC????????????????????в????
????reg query HKEY_LOCAL_MACHINESOFTWARERealVNCWinVNC4 /v password
????Putty
????reg query" HKCUSoftwareSimonTathamPuTTYSessions"
????????
????Registry?Щ??????????????
????reg query HKLM /f password /t REG_SZ /s
????reg query HKCU /f password /t REG_SZ /s
????Windows ????????
????reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentversionWinlogon"
????SNMP ????????
????reg query "HKLMSYSTEMCurrentControlSetServicesSNMP"
????PowerSploit???????
????PowerSploit????????????洢???????????????????????????????е????????plain-text??
Get-UnattendedInstallFile
Get-Webconfig
Get-ApplicationHost
Get-SiteListPassword
Get-CachedGPPPassword
Get-RegistryAutoLogon