SessionGopher

SessionGopher is a Windows PowerShell script that enumerates saved session data for PuTTY, WinSCP, SuperPuTTY, FileZilla, and Remote Desktop, recovering saved passwords where the client storage permits (a WinSCP master password prevents plaintext recovery). Locally it reads loaded user hives; local Administrator access is required to read all users' hives. Remote mode queries an authorized target, host list, or AD-discovered computer set over WMI/DCOM. Retrieving remote SuperPuTTY or FileZilla XML starts a remote PowerShell helper and stages file bytes in HKLM for retrieval. Local Thorough mode scans accessible filesystem PSDrives for .ppk, .rdp, and .sdtid files and reads PuTTY private-key contents; remote Thorough mode queries C: and reports matching paths, not key contents. The legacy script uses WMI v1 cmdlets for remote actions, so use Windows PowerShell 5.1 with authorized WMI/DCOM access.