Information leakage is one of the largest threats that corporations face, and much of it can be prevented
by educating users to properly secure their data.
Users being users and more likely human, however, will frequently save data to their local workstations
instead of on the corporate servers where there's a whole lot greater control and security.
Mature Metropia happens to have a search function that will, by default, scour all drives of the compromised
computer looking for files of your choosing.
So besides the search command.
There are also two other options, an interpreter script called file collector and a post module called
Enum Files.
All these options can help you download files from the target.
And you can choose any of them according to your needs.
So after you him interpretor shell on the machine, you can search for any file on the target.
Now, surely you shouldn't just blindly search for anything.
You can look for configuration files that contains passwords and keys and et cetera, et cetera.
Also, if you compromised an administrative machine, you can look for some additional network topology,
information, network configuration, et cetera, et cetera.
But anyway, the search command is very simple.
Type search F.
And then the filename that you want to find, windows dot any.
OK, so the result has two files.
If this is a standard text file, you can just view its content.
Cat C..
Windows.
When that any.
And another query with the search command.
To look for a Tomcat users file.
Serge F..
Tomcat users.
And here are the results.
Now, you can also perform your search on a specific directory.
All you need to do is just add the D parameter and and the folder name D c.
Manage engine.
And then after you find what you're looking for, you already know that you can download this file using
the download command.
And that's it, I just downloaded the Tomcat users file.
OK, so here is the file in my local storage.
So I can tend to that later.
But I want to show you another option, and that's to use the file collector script.
And this is the help menu for the script.
And the best feature of this script is that you can provide a list and then it can search and then download
that list.
And the parameters are very clear.
So I'm going to use the script with these parameters.
And hit enter.
Now.
I think the script is probably obsolete, so it doesn't work in my case, but the usage is like that
and.
You probably can run it in your environment.
Now, you also have a post module that will do what this script does.
So let's look at it here.
The information for Inam files post module.
And it also has the same search command for me, I prefer to use a search command.
But it's always better to know alternatives.
OK, run post.
Windows Gather.
Enum files.
Then.
File globs equals Tomcat.
That XML to look for files like that.
And search from C colon backslash, backslash to start the search from the C root directories windows.
And then the search runs.
And the post module also downloads the found files.
So why don't we check the files?
We'll copy the first file path.
And go to the next time I typically use Sublime to open files that you can use another text editor to
open files does matter.
Oh, look at that.
Nothing in this file.
OK, so I'll copy another one.
Open it with Sublime.
There we are, finally, you get some credentials.