Now I'm pretty sure you've already been thinking about like how this would be executed. Obviously
I've given you the link to the folder or to where to download it from. You know you have to have
Python on the system and you know you could run it on said system. But you may be wondering how
to do this on an actual target. Well this ties into our previous skill where we were looking
at actual physically taking away stuff and making a forensics copy of it for our use later on.
Let's say that you already have one of those forensics copies and you want to do a lot more
digging. Now tools like what you just seen they run based on the fact that all this information
is public knowledge on where the passwords are actually stored at. The Python scripts are
basically put together for us to compile and be ease of use. So when these are ran it's basically
doing all the legwork for us. We can manually go through and do this and do you know the EDB
databasing to go through and check everything through SQLite or whatever. But it's right here
for it along with many other tools doing the exact same thing. This is just one of the most prolific
ones and can go through and get a whole lot of information. What we do with that information
is what's important the most. Because just like you saw those network passwords in there that
were highlighted in blue that information could be used to help us connect to different types of
networks and gain further access across the organization's system and network and networking
devices based on the fact that we have all that privileged information now. Now what this doesn't
do it doesn't go through on the desktop and look for actual text document files that may contain
username and passwords because somebody or some user is basically lazy or doesn't have the
appropriate knowledge being educated to them from the IA folks or the cyber security experts. See
like in DoD we're required to take cyber awareness training once a year and stuff like this is brought
up in cyber awareness training to prevent users from storing their username passwords in an
encrypted text document on side of one of their systems in their profile. Because folks like us are
somehow able to get a hold of that system whether it be physically or remote access and we can start
pulling credentials along with with tools like this the actual certificates that are stored in
system. You may be familiar with PKI and the fact that you have signing and encrypting
allowed on site with some of your email servers. I'm not saying that you can actually go through
and copy the entire certificate and do it yourself and impersonate them but what you can do is get
the information pertaining to those certificates to start wreaking havoc just in case you're
pen testing with malicious intent which you shouldn't be. So these are just some of the
things to think about moving forward as far as like what to do after you've gotten into the
system overall. Can you dig a little bit further and start getting more info for the rest of the organization?