Skip to main content

​
Overview

The WifiProfile command enumerates saved WiFi profiles on the system and attempts to extract SSIDs, authentication types, and cleartext passwords/passphrases. This reveals previously connected wireless networks and their credentials, which can be valuable for gaining access to other networks or understanding the user’s physical locations.

​
Syntax

Seatbelt.exe WifiProfile
This command does not support remote execution.

​
Output

Returns WiFi profile information:
  • Profile name (SSID)
  • Authentication type (WPA2-Personal, WPA2-Enterprise, etc.)
  • Encryption type (AES, TKIP)
  • Cleartext password/passphrase (if available)
  • Auto-connect setting
  • Connection mode

​
Use Cases

  • Red Team
  • Blue Team
  • Extract WiFi passwords for network access
  • Identify corporate vs guest networks
  • Understand user’s physical movement patterns
  • Gain access to additional networks
  • Identify potential pivot points

​
Example Output

====== WifiProfile ======

[*] Enumerating saved WiFi profiles...

Profile Name         : CORP-WIRELESS
SSID                 : CORP-WIRELESS
Authentication       : WPA2PSK
Encryption           : AES
Key Type             : passPhrase
Key Content          : SuperSecret123!
Auto Connect         : True

Profile Name         : Guest-WiFi
SSID                 : Guest-WiFi
Authentication       : Open
Encryption           : None
Key Type             : None
Key Content          :
Auto Connect         : False

Profile Name         : HOME-NETWORK-5G
SSID                 : HOME-NETWORK-5G
Authentication       : WPA2PSK
Encryption           : AES
Key Type             : passPhrase
Key Content          : MyH0meP@ssw0rd
Auto Connect         : True

​
Remote Execution

This command does NOT support remote execution.
WiFi profiles are stored locally in the system and require local access to extract.

​
Detection Considerations

Moderate detection risk - reads WiFi profile XML files.
  • File Access: Reads XML files from C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\
  • API Calls: May use WLAN API functions
  • Privilege Requirements: Requires administrator privileges to extract passwords
  • EDR Telemetry: File access may be logged by security products

​
Defensive Recommendations

  • Monitor access to WiFi profile XML files
  • Alert on bulk WiFi credential extraction
  • Implement file integrity monitoring on profile directory
  • Correlate with other credential theft indicators