← Back to Academy

Academy Node

Passwords in Files

Passwords in files means discovered plaintext, encoded, or reusable secrets in shares, web roots, backups, scripts, or config files.

Beginner100 XPCredential Discovery

Why it matters

This is one of the most common OSCP foothold and lateral movement sources.

How to identify it

  • Config files
  • Scripts
  • Backup archives
  • Web.config
  • Groups.xml
  • KeePass/Excel/notes

BloodHound indicators

  • Credentials discovered outside BloodHound

NetExec commands

nxc smb 192.168.184.141 -u USER -p PASS --shares

Linux commands

grep -RniE 'pass|pwd|user|cred|secret|connection|string|password' loot/
find loot -type f \( -name '*.config' -o -name '*.xml' -o -name '*.txt' -o -name '*.ps1' \)

Expected output

  • username=password
  • connectionString
  • credential object

Success looks like

  • Cred validates
  • Cred cracks/decrypts

Failure looks like

  • Old password
  • Service-only creds
  • Encoded but not useful

Troubleshooting

  • Try password reuse
  • Check domain/local auth
  • Look for context near password

Common mistakes

  • Not testing across SMB/LDAP/WinRM/MSSQL
  • Assuming file owner equals credential owner

Alternative attacks

  • Kerberoast
  • ASREP

What to try next

  • Credential validation
  • WinRM
  • MSSQL
  • BloodHound

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.