Navicat privilege escalation and mssql password location for the off-star host registry

The location of the mssql password in the external host registry
1. HKEY_LOCAL_MACHINE \ SYSTEM \ LIWEIWENSOFT \ INSTALLFREEADMIN \ 11
2. HKEY_LOCAL_MACHINE \ SYSTEM \ LIWEIWENSOFT \ INSTALLFreeHost \
Navicat is a popular MySQL management tool, which can be found on many servers. There are two methods for Elevation of Privilege:

1. Find the password from the log file. navicat will save the operation log (for example, add an account) to loghistory.txt under My Documents \ Navicat \ MySQL \ logs. the lower part is loghistory.txt under the installation directory.

2. MySQL server information managed by navicat (usually a root account) exists in the registry, specifically under HKEY_CURRENT_USER \ Software \ PremiumSoft \ Navicat \ Servers, export the registry and import it to the local machine ..
 

From: spicy feixia