[PEN-TEST] Hard-coded passwords in WINNT directory?

[Jonathan Wrathall <JWrathall () JAWZINC COM>]

During a test of a client's IIS web server, I've encountered the following
scenario:

1.  I am able to view files in the WINNT directory using the "MS Index
Server '%20' ASP Source Disclosure Vulnerability" vulnerability.

2. I am able to connect to IPC$, and I've used dumpsec to get the userlist
etc.

3. The winnt/system32/repair/sam._ file does not appear to be present.

Can anyone suggest other files that might reveal hard-coded passwords, or
other valuable information?

Thanks,
Jon
_________________________________________________
Jonathan Wrathall, BCom
Security Consultant
JAWZ Inc.