Credential Access via MDT Shares

In an authorized assessment, enumerate a reachable SMB host for an accessible Microsoft Deployment Toolkit (MDT) deployment share, then inspect its Control\Bootstrap.ini and Control\CustomSettings.ini files for configured credentials such as UserID/UserPassword or DomainAdmin/DomainAdminPassword. Credentials are obtained only if the relevant settings are present and the account used for the SMB read has permission; anonymous access is not assumed. The procedure can be performed from the public Internet only when the SMB host is externally reachable and the share/files are readable there; otherwise it requires an internal route or other authorized network access.