So in this year, we're going to search for plaintext credentials are incorrect credentials enough?
So first, explain the what is on the file.
So this answer will be, uh, like contains the scripts that you can run whenever you are not able to
operate the computer.
In like you want to run the script.
And then you can write the script and answer it.
And you can put that script in the terms of the Windows operating system and search for that answer
and execute this group.
So this is the basics of this answer.
And there is one important concept, this answer that is OneTel files.
So these are written files are submitted to answer first, but these are available during the Windows
Up installation.
So there will be a Windows image.
If you want to customize your Windows image like windows, I guess what you want to add your own language,
like your own local language and you want to add some other software.
And these are the interface will run after the creation of the first user.
So you have set up your windows and then it will ask for the user password and you feel free to enter.
Then these annotations will execute with some credentials.
It means tells it to have some permissions and it will run the script and it will install some software.
So this is the purpose of unattended files.
These are used for customizing edition of the Windows installation.
So you need to restart every software on all the systems.
We can simply throw this on the first and it will install this software.
So with this already in place, you can have some print.
Experiences are incorrect.
And just because some services are software require the permission of higher priorities like those things
you did here were used to install the software on this software.
We can also give that service to you on the system.
So that is all for the first degree.
So you can you may contain the plain text message encoded, congesting that's based on your computer.
So in my computer, it does not help.
Uh, so let's go ahead and find this coming in an end.
And, uh.
So these are the unwritten first content, the formats like XML, text file, etc..
So Slasher's for Cassill such as.
Alright, let's go ahead and go to the rubber tree and then perform this operation.
So meanwhile, I'm going to tell you everything that is the first.
So this cease fires are used for preparing the system, uh, services.
You can see we have got the idea to not.
Well, let's go to this territory and check whether we have any credentials are not.
And program 636, and we are where we are, workstation resources, and you can see the text file,
so it says some partition and undetermined full unattended admin password star and the purpose not.
Working for them.
So these you can see the bird king for dinner and will be Oscar when the Windows installation.
So the dosage will be 800 by 680, so so we do not have any credentials.
So this is the resources of this maybe Windows washer machine, uh, currency.
Sure.
So let me stop this so you cannot see the contents of this bill first.
So you can also set, for example, for us.
So another thing is that it does disprove first, so these are also similar to Unidan first, this may
contain some, uh, important information since it's a large star such as.
So meanwhile, so let's go to the three and this one will open another common problem and we'll look
for extras and some extras and configuration files.
So we will look for the string that his password.
So if any file has the string password, then it will be displayed.
So to do that, we need to find Ishtiaq.
So.
This is similar to Bill, but it will support the experience.
Of course, they're there.
They're coming also support regular experience, but it is only to display the file, but it does not
search inside the inside the content of the file.
So we have finished here and password.
So.
So let's find the,
um, slash, as I said, actually very good as soon as I use for ignore case so that it will be anything
that'll be a small fee, it will be case insensitive password.
And let's just start out and start that again.
These are the configuration of files.
And you can see we have got this is this is not easy.
We can.
Yeah.
So we got all of the X Files.
We do not have any, uh, experts or any configuration files.
So this may be the bad for us, but it's worth noting checking this system files.
So here we got a lot of information you can see are the first order containing the password and also
the line that contained the password.
We can see this visit the OR.
And so it takes so much time for taking these passwords, if there is any way that containing the password
like password is Nikil, et cetera, like that, then it will be desperate.
So, OK, let me run this program in the background.
Let's open this now.
We can also query the registry and the content, some configuration data like how much screen Highton
with the pregnancy to start and which one should use and which character dos, etc., etc..
So I have this cheat sheet because I can't remember this, but it's of course no one can do this, but
you can just create the cheat sheet of this registry.
Ladies first.
If there is A, B and C, and we can, uh, query further printing faster if the password is stored
in this.
Uh uh, this is tricky.
So let's go ahead and take this one and hit enter.
So we do not have been we should say we got this issue was unable to find the key.
So now let's do this with rather.
So we have got a bunch of information, we don't know if there are any plaintext passwords we can see
here.
So we got only the username and Assadi and we do not get the, uh, plaintext password.
So this is just a private matter.
You need to try if they if the computers are old, like Windows XP and 2010, chances are somewhat of
a to certain parameters.
I don't think I have a system in a machine or it's just created this one.
So we do not find this really should go.
Now, another important thing is.
But Sessions so I have this party installed before I can see here and I have some storage sessions.
So these are the keys.
So let's go ahead to this story, so let's go ahead and copy this and let's see.
So this is still running, so let's go ahead and they will just press out and take the radio.
So this is a shelter.
I'm just showing you the details.
And the part.
So these are the properties are this party application, you can see how much a bold font, color,
height, burkas, etc. So one important thing is proxy settings.
So if you have the proxy settings enabled here, then you will see the plain text of proxy without opening
this.
But the application can see here the proxy localhost.
So here we do not have any value because I do not have a proxy at all, so you can also see the proxy
password here and proxy proxy username.
So the proxy username and password password, can we use it for this proxy so you can also get the proxy
and also displayed information so you can basically take all these properties.
So you can I do not have the proxy that's there is there are no worries at all.
If any organization have the proxy and undercharging or party, then you have these values of up.
You can see the character.
She's the tenant command.
So this is the main important thing, you can see the proxy information in the plain text
by using this registry so you can also search for any plaintext passwords stored in the registry.
Now, let's clear the screen with this one.
We are getting not only the names with the password in it, so still it's not it's running here.
So it's asking for a commission and a guarantee that this is for this federal commission and this is
for current users.
So I'm going to stop this now and also try this next one.
And we get to the things that are with the password in it.
So we have lots of those messages and we have the set of Papasso pictures of.
I do not have that I can see here the proxy password we have seen in the party sessions registry, so
we have got this proxy password.
So I think these are the basics, uh, not really the basics, you can find some juicy information credentials
from this comment.
So we see the other come and finish their comment to find the password in our first.
Alderney exemplifies our confusion first, and we'll also call it the registry for any information.
So most of the computers have the party because they're connected to some domain domain controller then.
Now they obviously need to log in the system from further what is required.
Uh, you can get the proxy information if there is any proxy in the plaintext was in plain text format.
So that's how far this year.
I hope you understood.
So even though we might not how we know we did not get any plaintext or incorrect passwords, but sometimes
in these of some files contain the password as a backup.