Their location can be found in: %appdata%\SolarWinds\FreeTools\Solar-PuTTY\data.dat The first thing that I would like to point out is that saved sessions are locally stored in a (not really) encrypted format as they are not protected by a master password choosen by the user.I exported all the saved sessions from one of the machines and decided to work offline trying to recover them all in plain-text. Unfortunately, there was no easy way to directly see the stored password but the “Export Sessions” functionality caught my attention. Solar PuTTY, allows its users to store sessions and credentials or private keys for an easy login. Solar-PuTTY is a solarwinds version (with improved GUI and couple more functionalities) of the already well known PuTTY, an SSH (and telnet) client for the Windows platform. It can be downloaded as a standalone executable from GitHub ( Source Code) or used via the Metasploit post-exploitation module: /post/windows/gather/credentials/solar_putty. SolarPuttyDecrypt is a post-exploitation/forensics tool to decrypt SolarPuTTY’s sessions files and retrieve plain-text credentials. Retrieve the Plain-Text Stored Sessions.
0 kommentar(er)
