# Credential Hunting

|              |                      |                      |                            |
| ------------ | -------------------- | -------------------- | -------------------------- |
| **Files**    | **History**          | **Memory**           | **Key-Rings**              |
| Configs      | Logs                 | Cache                | Browser stored credentials |
| Databases    | Command-line History | In-memory Processing |                            |
| Notes        |                      |                      |                            |
| Scripts      |                      |                      |                            |
| Source codes |                      |                      |                            |
| Cronjobs     |                      |                      |                            |
| SSH Keys     |                      |                      |                            |

## Files

### Configuration Files

* Usually ends in .conf, .cnf, .config

```shell-session
cry0l1t3@unixclient:~$ for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done
```

```shell-session
cry0l1t3@unixclient:~$ for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done
```

### Databases

```shell-session
cry0l1t3@unixclient:~$ for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";done
```

### Notes

```shell-session
cry0l1t3@unixclient:~$ find /home/* -type f -name "*.txt" -o ! -name "*.*"
```

### Scripts

```shell-session
cry0l1t3@unixclient:~$ find /home/* -type f -name "*.txt" -o ! -name "*.*"
```

### Cronjobs

```shell-session
cry0l1t3@unixclient:~$ find /home/* -type f -name "*.txt" -o ! -name "*.*"
```

### SSH Keys

#### Private Keys

```shell-session
cry0l1t3@unixclient:~$ grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"
```

#### Public Keys

```shell-session
cry0l1t3@unixclient:~$ grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"
```

\\

## History

### Bash History

```shell-session
cry0l1t3@unixclient:~$ tail -n5 /home/*/.bash*
```

### Logs

* Application Logs, Event Logs, Service Logs, System Logs

<table data-header-hidden><thead><tr><th width="213"></th><th></th></tr></thead><tbody><tr><td>/var/log/messages</td><td>Generic system activity logs.</td></tr><tr><td>/var/log/syslog</td><td>Generic system activity logs.</td></tr><tr><td>/var/log/auth.log</td><td>(Debian) All authentication related logs.</td></tr><tr><td>/var/log/secure</td><td>(RedHat/CentOS) All authentication related logs.</td></tr><tr><td>/var/log/boot.log</td><td>Booting information.</td></tr><tr><td>/var/log/dmesg</td><td>Hardware and drivers related information and logs.</td></tr><tr><td>/var/log/kern.log</td><td>Kernel related warnings, errors and logs.</td></tr><tr><td>/var/log/faillog</td><td>Failed login attempts.</td></tr><tr><td>/var/log/cron</td><td>Information related to cron jobs.</td></tr><tr><td>/var/log/mail.log</td><td>All mail server related logs.</td></tr><tr><td>/var/log/httpd</td><td>All Apache related logs.</td></tr><tr><td>/var/log/mysqld.log</td><td>All MySQL server related logs.</td></tr></tbody></table>

```shell-session
cry0l1t3@unixclient:~$ for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done
```

\\

## Memory and Cache

### Mimipenguin (requires root)

{% embed url="<https://github.com/huntergregal/mimipenguin>" %}

### LaZagne

{% embed url="<https://github.com/AlessandroZ/LaZagne>" %}

### Browsers

#### Firefox Stored Credentials

```shell-session
$ ls -l .mozilla/firefox/ | grep default 
```

#### Decrypting Firefox Stored Credentials

```shell-session
git clone https://github.com/unode/firefox_decrypt.git
```

```shell-session
$ python3.9 firefox_decrypt.py
```

#### Using LaZagne

```shell-session
$ python3 laZagne.py browsers
```
