> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/credential-harvesting/ssh-clients.md).

# SSH Clients

## PuTTY

### Sessions

```
Cmd > reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
Cmd > reg query "HKEY_USERS\<SID>\Software\SimonTatham\PuTTY\Sessions" /s
PS > Get-ChildItem -Path "HKCU:\Software\SimonTatham\PuTTY\Sessions" -Recurse
PS > Get-ChildItem -Path "Registry::HKEY_USERS\<SID>\Software\SimonTatham\PuTTY\Sessions" -Recurse
```

## WinSCP

### Sessions

* <https://winscp.net/eng/docs/faq_password>
* <https://github.com/anoopengineer/winscppasswd>
* [https://snovvcra.sh/2021/08/07/htb-rpg.html](https://snovvcra.sh/2021/08/07/htb-rpg.html#5-wake-from-death-and-turn-to-life)

```
Cmd > reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
Cmd > reg query "HKEY_USERS\<SID>\Software\Martin Prikryl\WinSCP 2\Sessions" /s
Cmd > for /f "tokens=*" %a in ('reg query "HKEY_USERS" ^| findstr /r "S-1-5-.*"') do @reg query "%a\Software\Martin Prikryl\WinSCP 2\Sessions" /s
PS > Get-ChildItem -Path "HKCU:\Software\Martin Prikryl\WinSCP 2\Sessions" -Recurse
PS > Get-ChildItem -Path "Registry::HKEY_USERS\<SID>\Software\Martin Prikryl\WinSCP 2\Sessions" -Recurse
```