Blind Files

In some cases during exploitation you as an attacker gain the ability to read arbitrary files. As an attacker you need go-to files that cover as many different OS versions as possible in order to either confirm exploitation or gather intelligence on the exploited system. For this we use a "blind file".

The files below are things to pull when all you can do is to blindly read. Examples of vulnerabilities or situations where this would be helpful might be: local file includes (LFI), directory traversals or remote file share instances like SMB, FTP, NFS or otherwise. Files that will have the same name across networks, Windows domains, and systems are noted below.

File Description / Importance
%SYSTEMDRIVE%\boot.ini A file that can be counted on to be on virtually every windows host. Helps with confirmation that a read is happening.WARNING - in more recent versions of Windows this file in no longer there.
%WINDIR%\win.ini This is another file that can be counted on to be readable by all users of a system.
%SYSTEMROOT%\repair\SAM %SYSTEMROOT%\System32\config\RegBack\SAM Stores user passwords in either anLM hashand/or anNTLM hashformat. The SAM file in \repair is locked, but can be retrieved using forensic orVolume Shadow copy methods.
%SYSTEMROOT%\repair\system %SYSTEMROOT%\System32\config\RegBack\system This is the SYSTEM registry hive. This file is needed to extract the user account password hashes from a Windows system. The SYSTEM file in \repair is locked, but can be retrieved using forensic orVolume Shadow copy methods.
%SYSTEMROOT%\repair\SAM %SYSTEMROOT%\System32\config\RegBack\SAM These files store the LM and NTLM hashes for local users. UsingVolume Shadow CopyorNinja Copyyou can retrieve these files.
%WINDIR%\repair\sam %WINDIR%\repair\system %WINDIR%\repair\software %WINDIR%\repair\security System registry hives.https://en.wikipedia.org/wiki/Windows_Registry
%SYSTEMROOT%\repair\SAM %SYSTEMROOT%\System32\config\SAM %SYSTEMROOT%\System32\config\RegBack\SAM Stores user passwords in either anLM hashand/or anNTLM hashformat. The SAM file in \repair is locked, but can be retrieved using forensic orVolume Shadow copy methods.
%SYSTEMROOT%\repair\SYSTEM %SYSTEMROOT%\System32\config\SYSTEM %SYSTEMROOT%\System32\config\RegBack\SYSTEM This is the SYSTEM registry hive. This file is needed to extract the user account password hashes from a Windows system. The SYSTEM file in \repair is locked, but can be retrieved using forensic orVolume Shadow copy methods.
%SYSTEMDRIVE%\autoexec.bat autoexec.bat is a startup script that executes at startup. AsWebopedia states, “Stands for automatically executed batch file, the file that DOS automatically executes when a computer boots up. This is a convenient place to put commands you always want to execute at the beginning of a computing session. For example, you can set system parameters such as the date and time, and install memory-resident programs.”
%SYSTEMDRIVE%\pagefile.sys This file is used by the operating system when there is not enough RAM (memory) in the system. It is a large file, but contains spill over from RAM, usually lots of good information can be pulled, but should be a last resort due to size.
%SystemDrive%\inetpub\logs\LogFiles IIS 7.x web server log file location.
%USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat Internet Explorer web browser history file (http://support.microsoft.com/kb/322916)
%USERPROFILE%\ntuser.dat User-level Windows registry settings (http://technet.microsoft.com/en-us/library/cc758618(v=WS.10).aspx)
%WINDIR%\System32\drivers\etc\hosts System hosts file for local translation of host names to IP addresses.
%WINDIR%\debug\NetSetup.log Shows issues when computers are joined to a domain.http://technet.microsoft.com/en-us/library/cc961817.aspx
%WINDIR%\iis[version].logwhere [version] = 6, 7, or 8 Internet Information Service (IIS web server) log files.
%WINDIR%\system32\CCM\logs\*.log Windows SCCM (System Center Configuration Manager) log files (http://technet.microsoft.com/en-us/library/bb892800.aspx)
%WINDIR%\system32\config\AppEvent.Evt %WINDIR%\system32\config\SecEvent.Evt Windows Event Logs.
%WINDIR%\system32\config\default.sav %WINDIR%\system32\config\security.sav %WINDIR%\system32\config\software.sav %WINDIR%\system32\config\system.sav Backup Windows registry files (http://forensics.wikia.com/wiki/Windows_registry_entries)
%WINDIR%\system32\logfiles\httperr\httperr1.log IIS 6.x web server error logs.
%WINDIR%\system32\logfiles\w3svc1\exYYMMDD.logwhere YYMMDD = year month day Web server log files.
unattend.txt, unattend.xml, unattended.xml, sysprep.inf Used in the automated deployment of Windows images and can contain user accounts. Sometimes found in the%WINDIR%\Panther\directory.

results matching ""

    No results matching ""