SessionGopher is a PowerShell tool designed to identify and retrieve saved session information from various remote access applications. It leverages WMI to query system settings, specifically targeting configurations related to tools like PuTTY, WinSCP, FileZilla, SuperPuTTY, and Microsoft Remote Desktop. This tool is intended for security professionals performing forensic investigations or red-team engagements to uncover potential access points and credentials.
SessionGopher's core strength lies in its ability to automatically decrypt and extract saved session information for multiple tools, reducing manual effort. It supports remote execution, allowing for analysis of systems without local access. The tool's thorough mode provides comprehensive scanning of drives for private key files, including PuTTY keys and RDP/RSA files, enhancing its investigative capabilities. The output can be easily formatted as CSV files for easy analysis and reporting.
- Core Functionality: Extracts saved session information (usernames, passwords, hostnames) from WinSCP, PuTTY, FileZilla, SuperPuTTY, and RDP.
- Remote Execution: Can be run remotely against target systems using credentials or local admin privileges.
- Thorough Mode: Scans entire drives for private key files (.ppk, .rdp, .sdtid) for comprehensive credential recovery.
- CSV Output: Exports extracted session data to CSV files for easy analysis and reporting.
- Extensibility: The PowerShell script is easily adaptable to retrieve additional information from other remote access tools or system configurations.
SessionGopher appears to be a mature tool with a clear focus and established functionality. It has been available since 2017 and has received updates, indicating ongoing maintenance. The README provides detailed usage instructions and examples, suggesting a reasonable level of documentation completeness.
Security analysts and penetration testers benefit from SessionGopher by providing a streamlined method for identifying potentially compromised systems and uncovering credentials stored in common remote access tools. It addresses the need for efficient credential recovery and offers a quick way to assess the security posture of systems that utilize remote access technologies, offering a value proposition over manual inspection or searching for configuration files.