rapid7/metasploit-framework — pull request #548 by veritysr (2012-06-30 03:57:29+00:00)
Title: Added Post: Windows unattend.xml creds

Windows Post module: Extract credentials from sysprep answer file

Sysprep answer files for recent releases of Windows are placed in
c:\Windows\System32\sysprep\unattend.xml. Any passwords that are
set using unattend.xml are stored in plaintext or using base64 encoding.

This module parses unattend.xml for usernames/password values of
the Administrator account and any other local accounts then decodes
them and stores them in loot.

Example unattend.xml file for testing can be found here:
http://tinyurl.com/d5nxve8