PuTTY Saved Sessions

PuTTY persists saved sessions in the Windows registry under the current user’s hive:

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\<session name>

Each session key holds the connection profile — hostname, port, username, tunnel settings, and proxy configuration. For post-exploitation this is a discovery goldmine (MITRE ATT&CK T1552.002 — Unsecured Credentials: Credentials in Registry, and TrickBot famously harvests exactly this key): the session list alone reveals which SSH hosts an admin connects to and as whom.

The cleartext password problem

Sessions that use a proxy connection with saved credentials store them unencrypted:

HKCU\Software\SimonTatham\PuTTY\Sessions\<session>\ProxyUsername   (REG_SZ)
HKCU\Software\SimonTatham\PuTTY\Sessions\<session>\ProxyPassword   (REG_SZ, cleartext)

PuTTY does not warn the user that the saved proxy password is stored in the clear (disclosed publicly in 2016; behavior unchanged since it’s a documented feature of the session format). Enumerate everything in one shot:

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /f "Proxy" /s

or read values directly with reg query ...\<session> /v ProxyPassword, or via PowerShell’s registry drives — see windows-registry-powershell.

Tooling

• Metasploit post/windows/gather/enum_putty_saved_sessions dumps session profiles; a 2020 PR added the ProxyUsername/ProxyPassword fields specifically.
• Manual batch one-liners from the original Bugtraq advisory iterate session subkeys and print any ProxyPassword found.
• SSH private keys are not stored in these keys (they live in .ppk files, and modern setups use Pageant/ssh-agent) — but session metadata plus key filenames often appear together.

Defense notes

• Don’t save proxy passwords in PuTTY sessions; use an authenticating proxy that supports integrated auth, or re-enter per session.
• Monitor registry reads against ...\SimonTatham\PuTTY\Sessions with value-name filters (password, Proxy) — high-fidelity credential-access signal (Sysmon EID 12/13 or registry SACLs + EID 4663).

Related

• windows-registry-powershell — navigating HKCU from PowerShell to read these keys
• unattended-installation-credentials — other plaintext-ish host credential leftovers (T1552 family)
• windows-saved-credentials — the OS-level credential store (Credential Manager)
• windows-reconnaissance-commands — reg query for discovery (T1012)

Sources

• MITRE ATT&CK T1552.002 — Credentials in Registry
• Seclists Bugtraq — Putty Cleartext Password Storage (2016)
• Metasploit PR #14311 — ProxyUsername/ProxyPassword in enum_putty_saved_sessions (2020)