Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?

Question

On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which do you grab first?

You only have the vulnerabilty at hand and nothing more of information (directory structure and similar is unknown at the point of compromise). The discovery and furter exploitation has to come from the file download vulnerability.

A few things come to mind:

• Source code. Potential information leaks about backends, configurations and so on.
• metabase.xml for IIS setups
• autoexec.bat incase there is anything juicy at startup

Answer 1

Off-the-cuff stuff I could script:

• Registry
• SAM (these two require compromising at the kernel level -- leaving as a reference)
• Active Directory DB
• Browser histories & cookies

Answer 2

To try to escalate, you could look for known versions of programs that are known to be vulnerable. You probably wouldn't need to download the whole thing, just enough to get the signature/version.

E.g. DLLs that would signal that an OS patch hasn't been applied. This would give you information you might want to launch another attack. (Or it would give you information that launching that attack would be useless and you should look elsewhere.)