You have already learned about dumping and saving plaintext passwords from the memory. However, sometimes, not all passwords are dumped. Not to worry; Metasploit has other post-exploitation modules, using which we can gather saved passwords of different applications and services running on the server we compromised.
First, let's check what applications are running on the machine. We use this command:
use post/windows/gather/enum_applications
We see the options; now all we need is our session, using the following command:
set session 1Run it and we will see the list of applications installed on the system:
Now that we know what applications are running, let's try to collect more information.
We will use use post/windows/gather/enum_chrome.
It will gather all the browsing history, saved passwords, bookmarks, and so on. Again, we set our session and run this:
We will see that all the gathered data has been saved in a txt:
Now we will try...