SSH Clients

PuTTY

Sessions

Cmd > reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
Cmd > reg query "HKEY_USERS\<SID>\Software\SimonTatham\PuTTY\Sessions" /s
PS > Get-ChildItem -Path "HKCU:\Software\SimonTatham\PuTTY\Sessions\" -Recurse

WinSCP

Sessions

• https://winscp.net/eng/docs/faq_password

• https://github.com/anoopengineer/winscppasswd

• https://snovvcrash.rocks/2021/08/07/htb-rpg.html#5-wake-from-death-and-turn-to-life

Cmd > reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
Cmd > reg query "HKEY_USERS\<SID>\Software\Martin Prikryl\WinSCP 2\Sessions" /s
Cmd > for /f "tokens=*" %a in ('reg query "HKEY_USERS" ^| findstr /r "S-1-5-.*"') do @reg query "%a\Software\Martin Prikryl\WinSCP 2\Sessions" /s
PS > Get-ChildItem -Path "HKCU:\Software\Martin Prikryl\WinSCP 2\Sessions\" -Recurse